Correct Reset Password Endpoint

## Correct Reset Password Endpoint

### Acceptance Criteria
1. Endpoint exists at `/user/reset-password` instead of `/user/{id}/reset-password`.
1. `POST` creates reset password token based on provided email address rather than trying to find the currently logged in user based on OAuth authentication.
1. `PUT` checks validity of token based on given user email address instead of OAuth.
1. Tokens expire after 1 ~~hour~~ day by default, but configurable per project.

Tests:
 1. [x] `POST` finds user by email address.
 1. [x] If no reset-password token exists that won't expire in the next 5 minutes, `POST` creates new token and set to expire within 1 day.
 1. [x] If a reset-password token exists that won't expire in the next 5 minutes, `POST` does not create a new token but sends the existent one instead.
 1. [x] `POST` creates email entity.
 1. [x] `POST` enqueues email job.
 1. [x] `POST` returns 204 without any content in the body.
 1. [x] `POST` returns 404 if account does not exist.
 1. [x] `PUT` returns 404 if token not found.
 1. [x] `PUT` returns 404 if token expired.
 1. [x] `PUT` returns 422 if request does not contain new password.
 1. [x] `PUT` returns 200 and user entity (without password) in response body on success.
 1. [x] `PUT` resets password.
 1. [x]  `PUT` deletes token.