Implemented reset password tokens

Fixes #5 

* Adds two new routes to create a reset_login_credentials token and use it to reset the login credentials
* Added eventstream events to API documentation
* Verify UserService config
* Use `log.Fatalf` instead of `panic()` for invalid command line arguments

:alarm_clock: :bomb: This means if an attacker has the `login_name` he could get a reset password token and reset the users password.