Add password reset

/to @raymondfeng 
/cc @sam-github

The entire password-reset feature is as follows:

> As a user of a LoopBack app, I should be able to enter my valid existing email address and receive an email
> containing a link to a page that allows me to change my password.

This patch only adds the basic mechanism to support creating a temporary session (defaults to 15 mins). The actual implementation of the rest of the feature, sending the email, creating the link, rendering the change email page, will be written in the workspace. Parts of that implementation will eventually be factored into this library as it makes sense.

The `resetPassword` method will only ever emit a `passwordResetRequest` event if the email provided is valid. No matter the input, the method will not ever callback with sensitive data. The only way the method will call back with data is if there is an error somehow in the callbacks for creating a token / finding the user / etc.

It would be helpful to get any feedback on the security of this solution. Are we leaking any information? Is it acceptable that the email will generate an actual full blown accessToken for the user (similar to logging in?).