PROV-835 Almost working version of authentication rewrite including password reset
PROV-835 Send message when account is deactivated

Also deactivate account in the isValidToken() phase of the protocol,
not only in requestPasswordReset()