after_sign_in is more readable
new default behavior: after sign up, expects to be logged in
new default behavior: after reset password, expects to be logged in, expects to be in after_reset page