Add initial support for media uploads

Add CORS headers to responses

Merge branch 'forgot-password' into master

Strip non-alphanumeric characters before parsing ForgotPasswordKey

Add endpoint for actually using forgot password keys to reset passwords

Add endpoint for checking forgot password key validity

Split forgot_password routes into module