def post(self, token):
user = User.get_by_token(token)
if not user:
raise APINotFound('token')
user.set_password(self.data['password'])
user.save()
delete_cache(token)
return 'password changed'