Implement password reset flow

[Ratler]

Context

The user should be able to reset their password when the password has been forgotten.

Acceptance criteria

• Add a password reset endpoint that emails the user a link with a temporary state token
• Validate the security question and answer (VA)
• The state token should be valid for the following criteria; the token remains valid until one of the following occurs: expiration (1-2 hours), password successfully changed.
• Send an email to the user with the link/reset token

Developer notes

• Ensure that passwords are never sent in plain text via email