Make password reset endpoint CSRF exempt

This is necessary for mobile apps

@nasthagiri @e0d 
Why is it necessary to flag this as `csrf_exempt`?  Instead of leaving it blank?