We're not testing the redirects anymore. But the error messages should be pretty clear already. We can start testing redirects again once we redirect to different places for different actions.

Identity.new.valid? should not crash. So validate presence where needed and
skip the other validations if the value is absent.

hash token with sha512 against timing attacs #3398

We create them. let's reflect that in the verb.

Only storing the date as that should suffice for normal expiry and is less useful for identifying users by timestamps