clean up reset email token code

WIP ...

- put route in sessions_controller
- inherit parameters from old token
- make it a get so it's linkable
- controller tests (with some cleanup)