Request password reset

MVP note: the reset link is shown as a flash message (you can wire email later).