s/forgotPasswordToken/passwordForgotToken/

We figured it was more important to match the API
name (/v1/password/forgot/*, which is sort of big-endian), even though
grammatically the token name would read better as
"forgotPasswordToken" (which is sort of little-endian). The specific
place that needs to match is the purpose/CTXinfo string passed into HKDF
when using this token to produce HAWK keys.