Move logic out of User and Classes controllers

into RestWriter

src/RestWrite.js

@@ -95,6 +95,9 @@ RestWrite.prototype.execute = function() {
     .then(() => {
       return this.runBeforeTrigger();
     })
+    .then(() => {
+      return this.deleteEmailRestTokenIfNeeded();
+    })
     .then(() => {
       return this.validateSchema();
     })
@@ -745,6 +748,22 @@ RestWrite.prototype.createSessionToken = function() {
   return createSession();
 };
 
+// Delete email reset tokens if user is changing password or email.
+RestWrite.prototype.deleteEmailRestTokenIfNeeded = function() {
+  if (this.className !== '_User' || this.query === null) {
+    // null query means create
+    return;
+  }
+
+  if ('password' in this.data || 'email' in this.data) {
+    const addOps = {
+      _perishable_token: { __op: 'Delete' },
+      _perishable_token_expires_at: { __op: 'Delete' },
+    };
+    this.data = Object.assign(this.data, addOps);
+  }
+};
+
 RestWrite.prototype.destroyDuplicatedSessions = function() {
   // Only for _Session, and at creation time
   if (this.className != '_Session' || this.query) {