Regen access key, remove user object

- Forgotten password no longer returns user object
- PasswordChangeResponseMaker now returns the updated accessKey
- User responder now correctly returning user object
- UserRepository methods hashAndStore and generateAndStore now call
generateAccessKey to create a new access key