Write API and tests for password reset