now, User.resetPassword doesn't require a token in order to be called
Signed-off-by: Daniel Meneses <daplay@gmail.com>