Adds password reset token and bcrypt password_hash() rehash
Reset token machinery
Editorconfig
Password reset now done by token, not emailed pw

Previous iteration created a 10char password and emailed it to the user.
We now generate a reset token and send that instead. The token expires
after 24 hours.