Trying to reset a password with an expired reset token should fail before asking user for new password

# Steps to Reproduce

1. Follow forgot password link
2. Get email with reset password link
3. Wait for 3 days
4. Follow link within the email
5. Fill out new password
6. Click submit

You will see this message:

# Expected

I would expect the system to tell me right away that the "Reset code is not valid" before asking me to submit a new password.

# Actual

The system allows me to send a password reset form. It is a waste of time. I would expect the error message right after step 4 (when I initially get to this page: https://www.bountysource.com/signin/reset)

# End goal

Improve usability and provide a better user experience.

Start by reproducing the reset flow at https://www.bountysource.com/signin/reset with a token older than three days, then trace where the token is checked and where the new-password form is presented. Done means an expired token is rejected immediately after opening the reset link, before the user is asked to enter or submit a password.

Written by the indexing model from the issue text.