don't need to be authed to use password reset or email verify
use user accounts and generated api keys correctly