Back end

One signed-in account runs this. It can reset a login, set a password, or remove an account. A PIN still works as a backup.