Password reset functionality

[timwis]

When a user forgets their password, they should be able to reset it via email authentication.

This is a huge pain in the butt. Makes me wish we went with Firebase, which offers it out of the box. Here's what I'm thinking so far:

• user hits reset password
• client app creates reset-token doc { type: ‘password-reset-token’, created: ‘2016-09-05T01:23:45Z’, user: ‘tester’, token: null }
  • but how to give anonymous users write access but not read access?
• server listens for new reset-token docs with null tokens
  • generate a token and update the doc with it (can it be hashed in case db is compromised?)
  • sends an email to the user with a link that includes the token (we’ll need to capture their email on signup)
• user receives a reset email with link /reset-password?token=xzcv098welkr
• client app generates a form with that token. form posts to server’s /reset-password api endpoint
• server, logged in as an admin, changes the user’s password

Other ideas:

• What if we just use oauth?
• SuperLogin looks like a pretty robust solution, but seems like more than I need.
• CouchDB-XO_Auth

[timwis]

Reopening as we need a user-driven reset function. The above pull request lets admins reset passwords.

[timwis]

Closing in favor of https://github.com/timwis/enviar/milestone/4