* Clean up cookie setting code in User

* Clean up cookie setting code in User
* Don't clear the token cookie when mailing a password -- this may belong to a different user entirely! If it's the same user, then no harm; the old cookie just won't have any affect. If they're making someone else's account, this will avoid clearing their own token.