I don't feel it's appropriate to do this on the python side as anyone can execute a script to edit a user. It's probably best if I instead implement this on the website side as so.
If a user has forgotten a gesture combination during login or logout, they are required to enter the opposing combination to reset it to a new combination.
If a user has forgotten both combinations, they will need a high similarity confidence face (95%+ maybe) to reset both.
In the long run, a verification code or link by email would be appropriate instead of just providing a high confidence face
Not sure what could be used as the mediator however (maybe the other combination or a face with a high confidence if neither of them are rememberable)