protected static function changePasswordBySecurityAnswer($email, $answer, $newPassword, $login = true)
    {
        if (empty($email)) {
            throw new BadRequestException("Missing required email for password reset confirmation.");
        }

        if (empty($newPassword)) {
            throw new BadRequestException("Missing new password for reset.");
        }

        if (empty($answer)) {
            throw new BadRequestException("Missing security answer.");
        }

        /** @var User $user */
        $user = User::whereEmail($email)->first();

        if (null === $user) {
            // bad code
            throw new NotFoundException("The supplied email and confirmation code were not found in the system.");
        }

        static::isAllowed($user);

        try {
            // validate answer
            $isValid = \Hash::check($answer, $user->security_answer);
        } catch (\Exception $ex) {
            throw new InternalServerErrorException("Error validating security answer.\n{$ex->getMessage()}");
        }

        if (!$isValid) {
            throw new BadRequestException("The answer supplied does not match.");
        }

        try {
            $user->password = $newPassword;
            $user->save();
        } catch (\Exception $ex) {
            throw new InternalServerErrorException("Error processing password change.\n{$ex->getMessage()}");
        }

        if ($login) {
            static::userLogin($email, $newPassword);

            return ['success' => true, 'session_token' => Session::getSessionToken()];
        }

        return ['success' => true];
    }