{action}-password route naming convention

[maxterry]

Currently all routes follow the {action}-password convention, except one.

password-reset should shift to reset-password for consistency.

https://github.com/mattboutet/user-pal/blob/master/lib/services/email.js#L30
https://github.com/mattboutet/user-pal/blob/master/lib/services/user.js#L144

[mattboutet]

Just to clarify: the api routes all follow the same action-password pattern (e.g. /users/reset-password) the thing that is going to change here is the link we send to the front end (https://github.com/mattboutet/user-pal/blob/master/lib/services/user.js#L144) and, in the interest of consistency, the email templates associated with it.