make password reset flows consistent

reset_account_password now takes a token as a string representation.
This makes sense because the string is going to be extracted from the
URL anyway, the method handles the object creation and password reset
as usual. This change is to be consistent with
verify_password_reset_token which also takes a string.