Set the default url for the mailer in test

- allows us to test that links are generated
Enable authentication for a review token
Ensure user is authenticated when editing a review
access_denied becomes forbidden