Implement proper password reset using tokens

[gr2m]

follow up for #2 (comment)

This PR needs the account server API to support tokens.

@rmehner also mentioned that password-reset is currently the only place we validate if the username is a valid email. This was a rather quick hack when I first implemented it, I think we can make it a bit more sophisticated, e.g. check if if there is an email property.

We should also support the ability to overwrite the password reset request with custom logic (like we plan to do with signup and the other account requests) to allow for custom logic