Reset password signs the user in

Closes #4196
- Clear confidential info on leaving reset route
- Remove nested password access, because gross
- Also cleaned up some .then(f, h) to .then(f).catch(h) in setup controller

`this._super()`?