Password reset

[polyccon]

Functionality for the users to reset their passwords should they forget them would be nice to add.

• /forgot GET: User enters email address
• /forgot POST:
  • Check entered email address is registered
  • Generate unique reset token
  • Store token and users email in redis
  • Email link containing token to user
  • Token should expire (see comment)
  • Token should be single-use (use del command after we've finished with it. All redis commands are available in node-redis module)
• /reset/:token GET:
  • Check token in url is valid by accessing it in redis
  • User enters new password (twice)
• /reset POST:
  • Get email associated with token being used
  • New password should be validated just like original one is (e.g. more than 8 characters)
  • Use email to update users password in db
  • Redirect to /login and provide success flash message

[dangerdak]

Add expiry to key: https://github.com/NodeRedis/node_redis#redis-commands

// this key will expire after 10 seconds
client.set('key', 'value!', 'EX', 10);