Fix last commit, which misplaced an ACL.

Move the ACL inside "acls".
Signed-off-by: Carey Richard Murphey <rich@murphey.org>

lib/models/user.js

@@ -85,6 +85,13 @@ var options = {
       principalId: Role.EVERYONE,
       permission: ACL.ALLOW,
       property: "confirm"
+    },
+    {
+      principalType: ACL.ROLE,
+      principalId: Role.EVERYONE,
+      permission: ACL.ALLOW,
+      property: "resetPassword",
+      accessType: ACL.EXECUTE
     }
   ],
   relations: {
@@ -93,13 +100,6 @@ var options = {
       model: 'AccessToken',
       foreignKey: 'userId'
     }
-  },
-  {
-    principalType: ACL.ROLE,
-    principalId: Role.EVERYONE,
-    permission: ACL.ALLOW,
-    property: "resetPassword",
-    accessType: ACL.EXECUTE
   }
 };