Add POST /reset_password

That takes a token and password and resets the user's account.

Closes #50