User authentication

Refactored user authentication code. Biggest change was creating a new `RememberToken` class so that the logic around the remember tokens wasn't spread out among `User` and `Session`. Also the first time I wrote tests for custom controller methods, so feedback on those would definitely be appreciated. Thanks to @yaychris for the refactor help and bettering my Vim-fu.
the unique index in the db won't fail, and that's the only thing I'd really be concerned about. The remaining concern is just a UX nicety. You just wouldn't be remembered if the token generated for your login request happened to be non-unique.