3rd-party apps are now forbidden from updating users (even with valid sessions)
added forgot password, update password, and update email interfaces with email-confirmation flow (close #45, close #32)