Update password reset request API

My first crack at fixing this did not work. The passing unit test did not reflect the runtime behavior, which was a 403 CSRF-relates error.

I rewrote the test to make sure it passed through the entire web stack, and then refactored the endpoint using the nested function style, incorporating signature checking and CSRF-exemption. I also added a check to see if the email was associated with an account and return a failure message if not. This prevents clients from showing a "check your email" message when the server did not even attempt to send an email.