Why would you even use blobs for forgot-password? Is there ever a reason to use them over a single-use, time-limited token?