Controller and model for reset password (i think the security token could be the apikey_write) so no changes in database are necesary