Use signed requests instead of tokens in the database for password resets

[airblade]

• https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/
• http://guides.rubyonrails.org/4_1_release_notes.html#message-verifiers
• http://brewhouse.io/blog/2013/12/17/whats-new-in-rails-4-1.html

[airblade]

Not planning to do this in v1.