Change password reset API endpoint

This endpoint has been broken since the creation of the API. Nesting the
password reset under users/{user-id} is not possible. If the user is
resorting to sending a password reset email, then they cannot log in and
the app cannot know their user ID.

This is a major change to an endpoint, however this cannot break any
clients, since no clients have ever hit this endpoint successfully. For
that reason, I am _not_ bumping the API version up from 3 to 4.