[FAS3] Make the reset-password system also specify the username

[puiterwijk]

This makes it practically impossible to start to randomly guess tokens and perhaps hit a valid one