document the whole login API dance a bit better
use fixture user/token in password reset test
add test for corporate users resetting their passwords; fix bug