Password reset

1) add PasswordResetController
2) add views for PasswordResetController
3) add specs for PasswordResetController
4) add code for PasswordResetController
5) add validation on password length

Please approve.
You probably do not want to give the user a message saying token creation failed. However, I would recommend giving a message such as "If blah@blah.com exists in our database, you will receive an email with reset instructions.", for both success and failure scenarios.