getting somewhere...
it looks like password reset is working but I've got memory leaks with DbContext. both OWIN and StructureMap are creating instances on each HTTPRequest.