Make the reset-password system also specify the username

This makes it practically impossible to start to randomly guess tokens and perhaps hit a valid one
Merge branch 'fas3-reset-password-username' into FAS_3.0