SD-882 : User is still created as a disabled by default

Changed the code for reset password
When the user is added it is by default active but need activation and
in UI will be shown as pending
The reason the api returns `201` is because the endpoint is public without auth so it's easy to try to find what email addresses are registered in the app.
I know this is weak, still I'm not sure returning 400 is the right thing to do.