Remember to call this._setLoginToken the other places we call this.setUserId

This makes me feel that this._setLoginToken is the wrong pattern even more strongly.
break 'long series' test into smaller tests.
add XXX note
Add test parameter so we only expire tokens for our user, not everyone.
Fix reset email test. NOTE: still needs work on error handling.
Fix typo in index name. We were not indexing password reset tokens correctly.
Specify userId in one other expireTokens call. Add a check to make sure we don't do it again.