Adding an error message to email reset form
Invalidate pwd reset token on login, pwd reset, email change.
Expire pwd reset token after 24 hours
Comment sweep - Result already has handling for reference problem

...so iterate over ResultSet
Don't present the password reset form if token is invalid
Invalidate sessions on password reset.

This covers the following conditions:

- When a password is reset within a session, all other sessions are logged out
- When a password is reset via password reset request, all sessions are logged out, including any sessions which set passwords in-session.
Password min length from 3 to 8 chars.
Merge pull request #222 from jbarrett/expire-pwd-reset-token

Reset password tokens