Add single-sign-on for password reset tokens
Implement authenticate at Staff/User authentication level

This allows SSO backends to ingore authenticate method