add "password reset" service
add doctest demonstrating the json required for a password reset
since the user will use a link (in their email), we need a GET handler redirecting them to the (angularjs) form
make sure not yet active users cannot request a password reset