Reset password signs the user in

Closes #4196
- Also cleaned up some .then(f, h) to .then(f).catch(h) in setup controller
(@erisds - this is what you were saying, I just had to get there myself)
Okay, so the first "catch" i added can now catch errors in the authentication step, whereas before it only caught errors in the ajax step.
the second .catch use to only catch errors in the validation.... and, that hasn't actually changed, because the "then" before it won't throw any errors.
So, just that first catch changes what'll happen. woooo.  and actually, it could be a good thing, as a failure in `authenticate` would actually throw api errors ^ ^
I think what this comes down to is... we need one function that intelligently handles all kinds of errors (we discussed this once before), and then we can just walk away from this whole debacle of "two catches for different errors"