Fix password method and ctrl names.
Define empty data object, reset status variables on new requests.
Set a tokenError on 404, not 500.
Add password errors and alerts.