Remove the internal API

* Bind sessions to identities
* Remove references to the identity token
* Move email changes to identity
* Move account menu into a turbo-frame
* Create tenants from a tenanted route

test/controllers/users_controller_test.rb

@@ -2,20 +2,31 @@ require "test_helper"
 
 class UsersControllerTest < ActionDispatch::IntegrationTest
   test "new" do
-    get new_user_path(params: { join_code: "bad" })
-    assert_response :forbidden
+    identity = Identity.create!(email_address: "new.user@example.com")
+    identity.memberships.create(tenant: ApplicationRecord.current_tenant, join_code: Account::JoinCode.sole.code)
+    sign_in_as identity
 
-    get new_user_path(params: { join_code: account_join_codes(:sole).code })
+    get new_user_path
     assert_response :ok
   end
 
+  test "new with invalid params" do
+    identity = Identity.create!(email_address: "new.user@example.com")
+    membership = identity.memberships.create(tenant: ApplicationRecord.current_tenant, join_code: "PHONY")
+    sign_in_as identity
+
+    get new_user_path
+    assert_redirected_to unlink_membership_url(script_name: nil, membership_id: membership.signed_id(purpose: :unlinking))
+  end
+
   test "create" do
+    identity = Identity.create!(email_address: "newart.userbaum@example.com")
+    identity.memberships.create(tenant: ApplicationRecord.current_tenant, join_code: Account::JoinCode.sole.code)
+    sign_in_as identity
+
     assert_difference -> { User.count }, +1 do
-      assert_difference -> { Identity.count }, +1 do
-        post users_path(params: { join_code: account_join_codes(:sole).code }),
-          params: { user: { name: "Dash", email_address: "dash@example.com" } }
-        assert_redirected_to session_magic_link_path(script_name: nil)
-      end
+      post users_path, params: { user: { name: "Newart Userbaum" } }
+      assert_redirected_to root_path
     end
   end