password reset, api authentication, session states
more consistent user-space structure