Split out sign_in/out functionality so it can be reused in hooks
Ensure timeoutable hook respects `Devise.sign_out_all_scopes` configuration

Closes #2606