until work is done to stop using PUT /user/{id} on the admin app, this function also needs to reset failed logins, cos it's used during the forgotten password flow