Here's another idea that avoids using verbs in the url, by treating the reset token like a resource:

POST /accounts/password/reset-token  // creates a new reset token (sent over email)
POST /accounts/password              // resets the password using the reset token