forgotPassword always uses the literal string "username"

The REST API is always expecting the literal string `username` in the request body.  Fix the JS SDK so it does that.