Add an API endpoint to reset a resource password

Also set an initial user password, and random passwords for all its
resources, on a CreateUser request.