Added support for reset password token. Fixed clean for users
* Added reset_token, and reset_expiration on user object
* reset_token stores unique token for resetting password
* reset_expiration stores expiration time for token
* sanitize of username and email was converting undefined to a string