Reset password signs the user in

Closes #4196
- Also cleaned up some .then(f, h) to .then(f).catch(h) in setup controller
This is a tricky one:

`something.then(onSuccess, onError)` - only one of `onError` and `onSuccess` will be called, so only errors in `something` are handled in `onError`
`something.then(onSuccess).catch(onError)`- in this case, any errors in `onSuccess` will also be caught by `onError`.

So in this case, the code has been changed to handle more errors, and in the inner block where `showAPIErrors` is called, it could be the case that a non-API error ends up being handled there?