you can't change this signature without changing the request handler of the route:

https://github.com/mozilla/fxa-auth-db-server/blob/master/bin/db_server.js#L85

The API scheme uses `tokenId` in the url and token object in the body. Lets try to stick with that as often as possible. I'm not opposed to renaming `tokenId` to `forgotPasswordTokenId` to make it more clear since its not the same kind of token as the request body.