Changed paths for reset password so they don't need to be authed.

So you now pass in the username.