Remove params that are not being used in resource params

[MaicolBen]

Redone #719, thanks to @jahammo2

[zachfeldman]

Makes sense to me. We only need UID of some kind and reset password token to do the work of that endpoint. Merging.

[mrkrlli]

@zachfeldman @MaicolBen

If we still allow the user to pass in redirect_url as a param for the POST request to /auth/password, wouldn't we still need to permit the redirect_url parameter? Otherwise an unpermitted parameter error is thrown.

It's a bit confusing, since the docs for the endpoint still say to pass in redirect_url, which would be required if the user doesn't set a default in the initializer.