Add password-reset signals for auditing

Also adds a bit of documentation for the signals API and the missing X-API-Key header instructions in the api docs