auth: move ResetPassword function

Now it's a method, and validates if the token belongs to the user.
auth: use ErrInvalidToken in other places
api: added resetPassword handler

This is the first step of the process: generating the token. Next step
is the actual password reset.

Related to #200.
api: finish resetPassword handler

Now everything we need is the command :-)

Related to #200.
auth: validate empty tokens on ResetPassword