forgot-password implemented.

Added implementation to allow password resets.
Basically, whenever a password reset is requested:
1. The requested destination email is checked for existance in the system.
2. Any old tokens are removed.
3. A token is created for the user.
4. An email is composed for the user and the reset URL is sent along.
5. Once successfully sent, a click on the URL and successful reset changes
   the password.

* Note, to be able to use gmail, make sure that the security settings on your account allow for use
  with nodemailer ie  `less secure apps`
What is this for? Protecting against someone accidentally writing `console.log(secret)`? If someone can run arbitrary code, they can just do `console.log(secret.gmail)`.