Add tests for pwd reset via token. Remove token from password form (it's in the URL)
Move pwd reset token to HTTP POST w/ own controller