don't hit API when checking new account email-token

we currently store new account email verify tokens in the database, and
check against that to work out if they've expired. But we don't need to
do that, tokens have their own timing mechanism. So lets just use that,
and free up the database to do other things.

Also, standardised the forgot password, change email, and new account
email verification timeouts to all be an hour, from the config val
'EMAIL_EXPIRY_SECONDS'

app/config.py

@@ -41,7 +41,7 @@ class Config(object):
         'local': 25000,
         'nhs': 25000,
     }
-    EMAIL_EXPIRY_SECONDS = 3600 * 24 * 7  # one week
+    EMAIL_EXPIRY_SECONDS = 3600  # 1 hour
     HEADER_COLOUR = '#FFBF47'  # $yellow
     HTTP_PROTOCOL = 'http'
     MAX_FAILED_LOGIN_COUNT = 10
@@ -56,7 +56,6 @@ class Config(object):
     SHOW_STYLEGUIDE = True
     # TODO: move to utils
     SMS_CHAR_COUNT_LIMIT = 459
-    TOKEN_MAX_AGE_SECONDS = 3600
     WTF_CSRF_ENABLED = True
     WTF_CSRF_TIME_LIMIT = None
     CSV_UPLOAD_BUCKET_NAME = 'local-notifications-csv-upload'