Fix Password Reset

The password reset functionality was broken when we upgraded Devise in 3e1691cc9b49849a921c639ad68d2947187159cf. It changed how the password reset token is derived and I didn't update our email template.

We didn't have a feature spec that fully covered the whole password reset flow, from beginning to end. I've added one now.