Integration-test password reset

[finishes #66792082]

This involves a tweak to the JSON we send back in /admin/users.json. We
now send users' confirmation and reset-password tokens. The information
is invisible to admins and inaccessible to anybody else.