API for password reset done. next: API to *request* a password verification code to be generated (will need a new DB field to flag which ones we haven't emailed)