Change password expired controller to properly redirect