api.md: /password/change also returns a keyFetchToken

We want this to grab kB before submitting an account reset.