clean up sign in and password set path; fix password set/reset controller and form when user it logged in. don't force them to log out to set the password from the email token. #downpayment