Make password reset endpoint CSRF exempt

This is necessary for mobile apps

@nasthagiri @e0d