Allows a non-admin user to reset their password without web access to the main site

Sends a new password to the account's email address. The auth value here is a one-time reset token (sha256(username . sha256(email))), not a session token or API key, which is why no security scheme applies. Send this as a POST where possible -- the token is a credential and a GET puts it in server logs, proxy logs and browser history where it can be reused. Note the request also triggers a side effect (the reset email), so avoid link prefetchers.