reset password

changes:
* added support that the package could be deployed to tomcat with maven
* added lost password form
* changed rest-call /app/rest/reset-password to anonymous authentication