Also fixes a bug with checking token validity dates, reorders some methods for clarity, and ensures that the login menu is not shown in the password reset screen.
This is the *only* way in which I could get the autoloader to work for both my production and my test code :(