Change urls

Closes #245 

Application number is now back in the form flow `/apply/application_number`

User session controller handles returning(`/application/returning`) and reminding(`/application/reminder`) users

I originally refactored the old authenticates method using try. The problem with this approach is that authenticate returns the object on success and false on failure or if nil is passed. Negating the response from this method also means that if claim is nil it adds a password error. & the issue with the first approach is that if you negate the authenticates method it will fall into the else and add a not found error for correct passwords.

My spider sense tingled on this one too & the fact that you've raised it again here just highlights its a smell. I think the solution is to say that these are two different validations. One is whether there is a claim & the other being whether the password matches(the constraint being a claim needs to exist to validate that condition)

Hows about this for an alternative: (omitted some noise from the class)

```ruby
class UserSession

  validate :presence_of_claim
  validate :password_authenticates, if: :claim

  def claim
    @claim ||= Claim.find_by_reference(reference)
  end

  private 

  def presence_of_claim
    errors.add(:reference, I18n.t('errors.user_session.not_found')) unless claim
  end

  def password_authenticates
    unless claim.authenticate(password)
      errors.add(:password, I18n.t('errors.user_session.invalid'))
    end
  end
end
```