Change password reset token when reset link is followed

This means that a password reset token will be changed within seconds
of being logged. That does mean that the links in emails will only
work once, so copy changes should follow to explain that.
Add error page to display when given an invalid token

Adds some basic tests for the error conditions.
Update emails to note that the reset link will only work once.
Merge branch 'two-phase-reset'

Conflicts:
	app/views/devise/mailer/reset_password_instructions.text.erb