Update password reset request API

My first crack at fixing this did not work. The passing unit test did
not reflect the runtime behavior, which was a 403 CSRF-relates error.

I rewrote the test to make sure it passed through the entire web stack,
and then refactored the endpoint using the nested function style,
incorporating signature checking and CSRF-exemption. I also added a
check to see if the email was associated with an account and return a
failure message if not. This prevents clients from showing a "check your
email" message when the server did not even attempt to send an email.
Merge pull request #1481 from jwalgran/topic/really-fix-pass-reset-api

Update password reset request API