[FAS3] Make the reset-password system also specify the username

This makes it practically impossible to start to randomly guess tokens and perhaps hit a valid one
If I recall correctly, top level functions need two empty lines according to pep8.
At least my pep8 verifier thought so.