Password recovery

If you have a valid token, set a new password. Otherwise generate a new request.