I'm still puzzled about that fact that we are storing the password reset URL, neither the *admin* of the UPS server, nor the database administrator, should know this URL.

The workflow for new users should be:

1- Register into the system
2- Provide username, password, confirmation of the password
3- Admin specify which role that user should have into the system

I'm also missing unit tests for it.