account activation
add password resets without email production config
refactor User#remember and User#create_reset_digest