Use Rails::cache for email login token

- Store token in Rails::cache instead of database
- Store remember_me and return_to in the token object
- Don't put extra params in the login link
- Use cache expiry to expire auth token
- Put token auth logic in Warden strategy
- remove old token auth fields from database

note: since more of the work is happening in warden, controller tests were acting strange. added capybara tests to compensate.
I don't think we should create a new token every time the user tries to sign in, because they may try several times in a row before the emails arrive in a flood, each with a different token. But I can raise that as a separate issue.