Refactor reverse proxy header parsing and use in password reset

[dbutenhof]

For password reset API email generation:

body=("Please reset your password at " + self.host + "/" + token),

self.host isn't ideal here; if the dashboard has been reaching the server through a reverse proxy, we ought to use that same path. This is OK for now, however; I'll convert this comment into an issue, which should be addressed by factoring the reverse proxy header logic out of /api/v1/endpoints so that it can be shared here. (Or anywhere else we want to report a URI to a client.)

Originally posted by @dbutenhof in #2491 (comment)