Implement secure password reset

Setting the new password directly and sending it by email is problematic, because the plaintext password will be stored in the inbox for an indefinite amount of time. It's better to generate a temporary token and let the user set their own password.

**Warning**
There's a new table `{prefix}password_reset_requests`