Added some logic to only allow one active password per user, added basic API router and tests