Bugfix/support authenticating after password reset

A few cleanup commits, and now using ```Warden.after_set_user``` instead of ```Warden.after_authentication```. This means we can force a 2FA verification at the right time.