Add tests for password reset

[timwis]

initReset

• [x] If no user found by email, return 200 and send an email anyway telling them there's no account by that email
• [x] If user found, generate a reset token, save it to their user document, and send it to them in an email

confirmReset

• [x] If no user found by token, return 404
• [x] If user found but token is expired, return 404
• [x] If user found with current token, update their password in the user doc, delete the resetToken section, and save it, returning 200