Change password reset API endpoint

This endpoint has been broken since the creation of the API. Nesting the password reset under users/{user-id} is not possible. If the user is resorting to sending a password reset email, then they cannot log in and the app cannot know their user ID.

This is a major change to an endpoint, however this cannot break any clients, since no clients have ever hit this endpoint successfully. For that reason, I am _not_ bumping the API version up from 3 to 4.