User API changes

closes #2822
- added destroy user method
- added remove user permission
- added API end point for get reset token
- added API end point for reset password
- added API end point for change password

Why not chain these promises out rather than nesting them like callbacks?