Changed forgotten requests

* Changed how password change request is called (id to username)
* Validate token reques for password change is now in API
* some fixes in Member class