User authentication

Refactored user authentication code. Biggest change was creating a new `RememberToken` class so that the logic around the remember tokens wasn't spread out among `User` and `Session`. Also the first time I wrote tests for custom controller methods, so feedback on those would definitely be appreciated. Thanks to @yaychris for the refactor help and bettering my Vim-fu.
Ah, I see what you mean. Are there any particular situations where that safeguard might fail? Or is it just a best practice, to-be-safe kind of thing?