Fix `/reset-password` flow

[maxachis]

Context

Per @joshuagraber:

Problem 1

When I call /reset-token-validation with the reset PW token from the link I am emailed, I get the following response.

{"message":"Token is valid"}

But when I pass that token to /reset-password, I get the following error:

{"message": "Invalid token."}

So it looks like something is disjointed on the API side with validating that reset token. Maybe it's not getting stored in the user DB or something?

Problem 2

Also, the API suggests that the data should include email for /reset-password:

  "email": "string",
  "password": "string",
  "token": "string"
}

But this route is unauthenticated, so I have no way of knowing the user's email. Could we either encode this in the token or return it from the /reset-token-validation endpoint?

Requirements

• Resolve the above bug with Problem 1
• For Problem 2, convert to JWT with sub body of:

  {
  "email": example@example.com
  "refresh_token": dflkajkjkdjijfk
  }

• Set expiration for password refresh token to 15 minutes.
• Remove reset_token table
• Bring /reset-token-validation up to par with other endpoints in terms of code design.

Tests

• Revise tests to test the full /reset-password flow, to ensure all components work as expected with each other

Docs

• API documentation will need updated

Open questions

• Any uncertainties? Anything we're flexible about?