Hide information about passwords if there was an error
Use redis storage for tokens

Tokens are now a SHA1 hash of the real SSP token and current
user email. They are stored on a redis server.

Verification URLs don't have the token visibile neither
email parameter anymore.
Remove tokens after using them