float flash on top of everything
handle reset password
refactor login/logout operations
implement reset password form
return email instead of user when validating hash
implement unsubscribe, verify email