SignupController: added CSRF checks to the signup pages.
Moved password reset pages to the `users.pages` package.
Wrote down some tasks to do next.