Add POST /reset_password_request

That takes an email or username and generates a token.

TODO: send-email with link