MDL-50803 login: Remove token from URL in forgot password process
MDL-50803 login: Remove token from URL in forgot password process

Store the token value in the session and redirect to self, thus
removing the token from the URL and eliminating the problem where
the token is exposed via the http referer header.

dilawar/moodle