User authentication

Refactored user authentication code. Biggest change was creating a new `RememberToken` class so that the logic around the remember tokens wasn't spread out among `User` and `Session`. Also the first time I wrote tests for custom controller methods, so feedback on those would definitely be appreciated. Thanks to @yaychris for the refactor help and bettering my Vim-fu.
okay, that's a good safeguard. but if it's not unique, there's no handler here to try the update again with a different token. Maybe not a big deal.