Make password reset endpoint CSRF exempt

This is necessary for mobile apps

@nasthagiri @e0d 
Views are CSRF protected unless the csrf_exempt decorator is used. The ensure_csrf_cookie that was previously on the function does not actually do CSRF protection but ensures that the CSRF cookie is set when the view is requested (which is something you are supposed to do for a page that makes AJAX requests, not an API endpoint).