feature(users): making nicer lost password process

1. User clicks "forgot password" and makes request
2. User receives via e-mail a URL to reset password
3. Accessing URL gives user a form to set her new password (uses temporary session bound to user account, but not logged in)
4. If password fields agree (and pass requirements), the password is set on the account, and the user is logged in.

There's just no need for the temporary password and forcing the user to login and change it.

Fixes #5886
chore(users): differentiating between user changing password and admin reset
security(users): making change password emails expire
chore(users): refactoring password reset action and function

Password reset action is using force_user_password_reset function.
The execute_new_password_request function sends the password by email
when it's generated randomly.
chore(users): logs the user in after a successful password reset
Merge pull request #6437 from sembrestels/reset-password

Forgot password made nicer