Use a variable for token expiration - default it to 24 hours

Currently the tokens will work for 30 days which is a departure from the default in Drupal core of 24 hours. I suggest using the variable user_password_reset_timeout to determine how long links should work and defaulting the value to 24 hours. See #246029: Use a variable for the timeout/expiration of user password reset links (followup) for details on the variable.

Also, if cron stops working on a site then tokens could get old. The query to fetch the token should apply a condition that the token is younger than the variable.