probleme PHP token

<?php
if(!empty($_POST) && !empty($_POST['email'])){
    require_once 'inc/db.php';
    require_once 'inc/functions.php';
    $req = $pdo->prepare('SELECT * FROM cafeland_users WHERE email = ? AND confirmed_at IS NOT NULL');
    $req->execute([$_POST['email']]);
    $user = $req->fetch();
    if($user){
        session_start(); 
        $reset_token = str_random(60);
        $pdo->prepare('UPDATE cafeland_users SET reset_token = ?, reset_at = NOW() WHERE id = ?')->execute([$reset_token, $user->id]);
        $_SESSION['flash']['success'] = "Les instructions du rappel de votre mot de passe vous ont été envoyées par email. Si vous n'avez rien reçu, pensez à vérifier dans vos spam.";
        $to      = $_POST['email'];
        $subject = 'Mot de passe oublié';
        $message = "Vous avez demandé la réinitialisation de votre mot de passe.\n \nAfin de réinitialiser votre mot de passe, merci de cliquer sur ce lien.\n \nhttps://www.cafeland-celebrity.com/reset.php?id={$user->id}&token=$reset_token";
        $headers = array(
            'From' => 'admin@cafeland-celebrity.com',
            'X-Mailer' => 'PHP/' . phpversion()
        );
        mail($to, $subject, $message, $headers);
        header ('Location : login.php');
        exit();
    }else{
        $_SESSION['flash']['danger'] = 'Aucun compte ne correspond à cette adresse';
    }

}

require 'inc/header.php'; 
?>

<h1>Mot de passe oublié</h1>


<form method="POST" action="">
    <div class="form-group">
        <label for="">Email</label>
        <input type="text" name="email" class="form-control" required>
    </div>
    <button type="submit" class="btn btn-primary">Réinitialiser</button>
</form>

<?php require 'inc/footer.php';?>

<?php
if(isset($_GET['id']) && isset($_GET['token'])){
    require 'inc/db.php';
    require 'inc/functions.php';
    $req = $pdo->prepare('SELECT * FROM cafeland_users WHERE id = ? AND reset_token IS NOT NULL AND reset_token = ? AND reset_at > DATE_SUB(NOW(), INTERVAL 30 MINUTE)');
    $req->execute([$_GET['id'], $_GET['token']]);
    $user = $req->fetch();
    if($user){
        if(!empty($_POST)){
            if(!empty($_POST['password']) && $_POST['password'] == $_POST['password_confirm']){
            $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
            $pdo->prepare('UPDATE cafeland_users SET password = ?; reset_at = NULL, reset_token = NULL')->execute([$password]);
            session_start();
            $_SESSION['flash']['success'] = 'Votre mot de passe a bien été modifié.';
            $_SESSION['auth'] = $user;
            header('Location : account.php');
            exit();
        }
    }  else {
        session_start();
        $_SESSION['flash']['error'] = "Ce token n'est pas valide";
        header("Location:login.php");
        exit();
    }
}
}   else {
        header ('Location : login.php');
        exit();
}
?>   

<?php require 'inc/header.php'; ?>

<h1>Réinitialisation du Mot de Passe</h1>


<form method="POST" action="">
    <div class="form-group">
        <label for="">Nouveau mot de Passe</label>
        <input type="password" name="password" class="form-control" required>
    </div>
    <div class="form-group">
        <label for="">Confirmation du mot de Passe</label>
        <input type="password" name="password_confirm" class="form-control" required>
    </div>

    <button type="submit" class="btn btn-primary">Réinitialiser votre Mot de Passe</button>
</form>

<?php require 'inc/footer.php';?>

<?php
echo '<pre>';
print_r($_GET['id']);
echo '<pre>';
print_r($_GET['token']);
exit;

<?php

if(isset($_GET['id']) && isset($_GET['token'])){
    require 'inc/db.php';
    require 'inc/functions.php';
    //echo '<pre>';
    //print_r($_GET['id']);
    //print_r($_GET['token']);
    $req = $pdo->prepare('SELECT * FROM cafeland_users WHERE id = ? AND reset_token IS NOT NULL AND reset_token = ? AND reset_at > DATE_SUB(NOW(), INTERVAL 30 MINUTE)');
    $req->execute([$_GET['id'], $_GET['token']]);
    $user = $req->fetch();
    //echo '<pre>';
    //print_r($req);
    //print_r($user);
    if($user){
        if(!empty($_POST)){
            if(!empty($_POST['password']) && $_POST['password'] == $_POST['password_confirm']){
                $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
                $pdo->prepare('UPDATE cafeland_users SET password = ?; reset_at = NULL, reset_token = NULL')->execute([$password]);
                session_start();
                $_SESSION['flash']['success'] = 'Votre mot de passe a bien été modifié.';
                $_SESSION['auth'] = $user;
                header('Location : account.php');
                exit();
            }
        }
    }  else {
**********************************************************je suis ici
        session_start();
        $_SESSION['flash']['error'] = "Ce token n'est pas valide";
        header("Location:login.php");
        exit();
    }

}   else {

        header ('Location : login.php');
        exit();
}
?>   

<?php require 'inc/header.php'; ?>

<h1>Réinitialisation du Mot de Passe</h1>


<form method="POST" action="">
    <div class="form-group">
        <label for="">Nouveau mot de Passe</label>
        <input type="password" name="password" class="form-control" required>
    </div>
    <div class="form-group">
        <label for="">Confirmation du mot de Passe</label>
        <input type="password" name="password_confirm" class="form-control" required>
    </div>

    <button type="submit" class="btn btn-primary">Réinitialiser votre Mot de Passe</button>
</form>

<?php require 'inc/footer.php';?>