rework IsPasswordExpired so userAccount doesn't have dependency on SecuritySettings.Instance
make setters internal
move logic for auto account verification and is login allowed to service to remove useraccount dependency on security settings
add classes for decoupling notifications and validation
comment out userAccountRepo
empty username, email, passwords are now validation exceptions
rework notification mechanism to use events
remove dependency on global SecuritySettings
rework authenticate to take lockout values from settings, not as method params
remove change password on useraccount; moved authentication check to user account service
rework reset password to not return bool
rework user account service to use better decoupled validation approach
add validation check that new password must be different than old password
add back in AuthWithEmail APIs; rework password hashing for new accounts