Create tests for multiple live token cases

WIP DO NOT MERGE

- test to ensure that token is valid even after user requests multiple other tokens
- (pending) test to ensure that other tokens are invalidated

addressing @polastre's comments in #205 ...

when: generate token 1 and then generate token 2
ensure:
- log in with token 1 (it still works)
- token 2 is either invalidated or expires (either one)

login in with token 1 (or any token) works and test for it is at https://github.com/18F/myusa/blob/328fc6281279bbdfa179e2fe97210b62f7af9fc1/spec/lib/email_authenticatable_spec.rb#L98-L105

invalidate/expire all other tokens, test is at https://github.com/18F/myusa/blob/328fc6281279bbdfa179e2fe97210b62f7af9fc1/spec/lib/email_authenticatable_spec.rb#L107-L109 ...

 it is pending b/c right now i can't look tokens up by user (because they are keyed off of user id in the cache). if we want to query by either user or hashed token, we should consider putting these back in the database ... 

going to move tokens to mysql so that they can be queried for