`do_reset` in `auth.py` has sharp edges that should be filed down.

[cubes]

do_reset in auth.py has a sharp edge:

This function takes an iterable of stuff, i.e. guests, updates all the guests's password to the same password, and then emails an individual email with the new password. In practice, I think this is ok because it get's called like this:

    guests = Guest.objects.filter(email=email, can_login=True)
    if guests.count() > 0:
        do_reset(guests)
        return

... and, in practice, I don't think the data model supports having more than one Guest record with the same email.

That said, if you were to do something like the following:

    d_reset(Guest.objects.all())

... bad shit would happen.

[otakup0pe]

This is a side effect of the weird Guest as "users" model, and the data model supports (and sadly, relies) on multiple guests with the same email / jwt.

#61 will make this go away.

[cubes]

Ok, as a stop-gap, could we modify do_reset to filter the input iterable to just the guests whose email matches the email of guests[0]?

[otakup0pe]

I guess? The only place do_reset is called is from reset_otp where it is explicitly passed Guest.objects.filter(email=email)