it's possible change a password without owning the account. #160
Description
it's possible to change the password of any account only with post an email on user/forgot and using the id of the user on user/store-password
Not only that, when post to /user/forgot endpoint is sending the private token in the response.
