passwords controller specs: changed context to "with email and token"