token reset

        //
        // GET: /Account/Upgrade
        [HttpGet]
        [AllowAnonymous]
        public IActionResult Upgrade(string returnUrl = null)
        {
            if (User.Identity.IsAuthenticated)
            {
                return RedirectToAction("Index", "Home");
            }
            ViewData["ReturnUrl"] = returnUrl;
            return View();
        }

        //
        // POST: /Account/Upgrade
        [HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Upgrade(UpgradeViewModel model, string returnUrl = null)
        {
            ViewData["ReturnUrl"] = returnUrl;
            if (ModelState.IsValid)
            {
                if (User.Identity.IsAuthenticated)
                {
                    return RedirectToAction("Index", "Home");
                }
                var user = await _userManager.FindByNameAsync(model.UserName);
                var password = CreateMD5("2011" + model.Password).ToLower();

                if (user != null && user.PasswordHash == password)
                {
                    var code = await _userManager.GeneratePasswordResetTokenAsync(user);
                    return RedirectToAction(nameof(Finalize), new { code, user.UserName });
                }
                else
                {
                    ModelState.AddModelError(string.Empty, "Identifiant ou mot de passe incorrect.");
                }
                return View(model);
            }

            // If we got this far, something failed, redisplay form
            return View(model);
        }

        //
        // GET: /Account/Upgrade
        [HttpGet]
        [AllowAnonymous]
        public IActionResult Finalize(string code, string UserName)
        {
            if (User.Identity.IsAuthenticated)
            {
                return RedirectToAction("Index", "Home");
            }
            var model = new FinalizeViewModel();
            model.UserName = UserName;
            model.code = code;
            return View(model);
        }

        //
        // POST: /Account/Upgrade
        [HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Finalize(FinalizeViewModel model, string returnUrl = null)
        {
            ViewData["ReturnUrl"] = returnUrl;
            if (ModelState.IsValid)
            {
                if (User.Identity.IsAuthenticated)
                {
                    return RedirectToAction("Index", "Home");
                }
                var user = await _userManager.FindByNameAsync(model.UserName);
                if (user == null)
                {
                    // Don't reveal that the user does not exist
                    return RedirectToAction(nameof(AccountController.Upgrade), "Account");
                }
                await _userManager.UpdateSecurityStampAsync(user);
                var result = await _userManager.ResetPasswordAsync(user, Model.code, model.Password);
                if (result.Succeeded)
                {
                    return RedirectToAction(nameof(AccountController.Login), "Account");
                }
                AddErrors(result);
                return View(model);
            }

            // If we got this far, something failed, redisplay form
            return View(model);
        }