* Remove forceAuth from Session, add isForceAuth to the relier
* Pass the broker to all views.
* Add a test for the confirm_reset_password page to ensure XSS emails do not make it through.