Make password reset endpoint CSRF exempt

This is necessary for mobile apps

@nasthagiri @e0d 
Ok, I see.  So our platform-wide setting is to have CSRF protected by default.