[FAS3] Make the reset-password system also specify the username

This makes it practically impossible to start to randomly guess tokens and perhaps hit a valid one
ah, my bad I mis-counted the number of lines