skip authenticate_account_from_token! for api/accounts#password & send_password