Minor app.rb code tweaks

Changes redirects in multiple routes to return a view instead.

I sprinkled a TODO comment in there to remind me to add content for the
'Password Reset' e-mail.
Changed api routes for consistent 'OK' response

Some of the /api/ routes returned things like 'ok' and { msg: 'ok' },
so those routes were changed to instead return { message: 'ok' }
Added tests for /api/login