Add the anonymous CSRF token on password reset (bug 1069546)

This fix potentially introduces a security flaw so I need double check prior merging :)