forgot-password implemented.

Added implementation to allow password resets.
Basically, whenever a password reset is requested:
1. The requested destination email is checked for existance in the system.
2. Any old tokens are removed.
3. A token is created for the user.
4. An email is composed for the user and the reset URL is sent along.
5. Once successfully sent, a click on the URL and successful reset changes
   the password.

* Note, to be able to use gmail, make sure that the security settings on your account allow for use
  with nodemailer ie  `less secure apps`
Why are you exposing the password length constants as a virtual value? It doesn't appear to be used anywhere.