add two account management APIs /forgotpassword and /passwordReset

curl http://localhost:3000/user/forgotpassword?email=xxx@gmail.com
this will send email to user with the access_token embedded in the link

after UI verifies the access_token,

it will invoke passwordReset API: 
curl -data "email=xxx@gmail.com&password=1234" http://localhost:3000/user/passwordReset