add new forgotten password model

@buildmaster is this the right idea?
this should reference HoistUser (ref: HoistUser) as that allows you to use populate methods