User API changes

closes #2822
- added destroy user method
- added API end point for get reset token
- added API end point for reset password
- added remove user permission