Redirect user to new password change page [MJ-251]

Also cleans up a few unused url routes and templates. Minor derp in the first commit message - this doesn't touch login.

All tests pass.