One Time Token should not be created if user does not exist

[rwinch]

Currently One Time Tokens are created and then the success handler is invoked even if the user does not exist. We should only generate a token and invoke the success handler if a user exists. We should also pass the user to the success handler so it can be used by the success handler without the need to look up the user again.

NOTE: Consider a resulthandler that does both success/failure. Failure is indicated by the ott not generated. Need a new method to pass in the UserDetails on success anyway. Failure should be handled the same as success so as not to reveal information to the end user so this helps to use ensure logic is the same and that a functional API can be used. Alternatively could have two methods on the new interface but might encourage users to handle the logic differently.

If user exists

• generate a new ott
• invoke success handler

If user does not exist

• do not generate ott
• do not invoke success handler
• invoke failure handler
• log.debug ott not generated