Change password reset API endpoint

This endpoint has been broken since the creation of the API. Nesting the
password reset under users/{user-id} is not possible. If the user is
resorting to sending a password reset email, then they cannot log in and
the app cannot know their user ID.

This is a major change to an endpoint, however this cannot break any
clients, since no clients have ever hit this endpoint successfully. For
that reason, I am _not_ bumping the API version up from 3 to 4.
Merge pull request #1479 from jwalgran/topic/fix-password-reset-api-endpoint

Change password reset API endpoint
Update password reset request API

My first crack at fixing this did not work. The passing unit test did
not reflect the runtime behavior, which was a 403 CSRF-relates error.

I rewrote the test to make sure it passed through the entire web stack,
and then refactored the endpoint using the nested function style,
incorporating signature checking and CSRF-exemption. I also added a
check to see if the email was associated with an account and return a
failure message if not. This prevents clients from showing a "check your
email" message when the server did not even attempt to send an email.
Merge pull request #1481 from jwalgran/topic/really-fix-pass-reset-api

Update password reset request API
Fix lint
Fixes OpenTreeMap/otm2-addons#158

Conflicts:

	opentreemap/treemap/css/sass/partials/pages/_addtree.scss
Fixes OpenTreeMap/otm2-addons#156
Fixes #1451
Merge pull request #1483 from mtedeschi/release-fixes

Release styling fixes
Merge remote-tracking branch 'upstream/release'