resetPassword(ident uid, string reset, string password) {
  assume exists //accounts/account[username]/reset; # reset code was requested before, implies account exists
  assume //accounts/account[username]/reset = reset; 
 
  remove //accounts/account[username]/reset;
  update //accounts/account[username]/password password;
}