move hooks to events, add forgot password/password reset, add email verification