User API changes

closes #2822
- added destroy user method
- added remove user permission
- added API end point for get reset token
- added API end point for reset password
- added API end point for change password

Can this comment die if you're closing 2822?