Clear password reset tokens on password change

Conflicts from devel:
	History.md
Disallow EJSON custom types as replacement documents in updates
Disallow mixed modifier/non-modifier fields in updates

We expect modifiers to be either modifiers or replacements, not a
mix. MongoDB does this check also, but do it in meteor too as a safety
belt.