Draft of all URL endpoints

After POSTing to the "forgot" endpoints, we need to send the user to a confirmation page. Do we just want to reuse the existing endpoints and something like

```
/login/forgot-password?sent=true
```

?