add new forgotten password model

@buildmaster is this the right idea?
this should just be the string 'HoistUser' you don't want to go and require('./hoist_user.js') as you many end up in circular territory. Mongoose will do the work.