Refactored user model and passwords controller

* Extracted user lookup by token to the user model rather than
duplicated within the controllers
* Make sure that we don’t return the first user with a blank
password_reset_token
* Now resets the token upon successful password update, preventing
reuse of token
Tidying up forms
Added registration workflow for improved U/X

Rather than forcing a user through a reset password workflow we now
have a basic ‘invite’ workflow so that it’s less jarring to the user
and provides better language
Removing dead code