Make a config for the number of hours a self-service password reset is valid