from code review. remove create password, rename loginUser to revalidateSession, and add forgot password link to change password ui