New routes are:
POST /users/register (args: name, email, pw_hash)
_GET /users/validateregistration/ (for use via email-link only)
POST /users/reset_password (args: name, email, pw_hash -> for new pw)
_GET /users/validatepassword/ (for use via email-link only)
POST /users/change_password (requires oauth('write_account_data'), args: name, pw_hash_old, pw_hash_new)
POST /users/change_name (requires oauth('write_account_data'), args: desired_name)