fix password reset and change to our own method instead of devise

+ fix the related test that didn't catch the earlier bug here.

When reviewing, make sure the Travis tests pass (as I had issues testing the whole set on my machine as DB already in develop branch state, and didn't want to hassle as trusting to travis now. :))