Better error message
Client auth for password reset is now expected to be in the Authorization header.
Updated tests for password-reset
No longer need to send the ClientModel to users.js or user-verification.js