revamp session management.  on any failure, reauth with backoff.
post email in body of reset password request. default principals endpoint for reset password. backoff a maximum number of steps.
bump version