Discussion of proposed design for careteam work

Available for review, but please don't merge yet.
Specifically, if I know the `userId` of someone (it's public, so if I can see the data of someone I just need to look at the URL for instance), as well as that person's `username` (email), I can just do a "forget password", then use `POST /confirm/send/forgot/:userid` with a new password. (Because of the absence of a confirmation key needed to reset the password, that would be only available in the link sent in the email).