Make the reset-password system also specify the username

This makes it practically impossible to start to randomly guess tokens and perhaps hit a valid one