Resetting the second factors of a privileged-group member now needs
golem15.users.manage_privileged_groups, as changing their password or
deleting them does; without it the action answers 403 before Reset.
- TestLoginGates: registry order, first result or error wins, nil gates,
concurrent Add and Check, CheckLoginGates without a registry
- TestLoginGateOrder: refused first factors never reach a gate, rehash
before a challenge, restore and reactivate mail only after the gates,
gate answers pass through, refresh never asks a gate
- TestPasswordChangedSources: reset, change and admin set fire once inside
the write's transaction; rehash and registration fire none
- TestResetTwoFactorAction: offered only with a service and a factor,
danger, permission, transaction and rollback
