Reset password signs the user in

Closes #4196
- Also cleaned up some .then(f, h) to .then(f).catch(h) in setup controller
Actually, I might be completely wrong here.  I've been bitten by differences between the two in the past but I'm testing it out now and it is not behaving like I described above.

If you've tested it, feel free to disregard :smile: