Staff directory
POST /api/reset/request {"email"} · POST /api/reset/confirm {"email","code","new_password"}
POST /api/login {"email","password"}