User API changes

closes #2822
- added destroy user method
- added remove user permission
- added API end point for get reset token
- added API end point for reset password
- added API end point for change password

It's consistent with how the code looks elsewhere in the API, although is a potential future cleanup job