Prevent a user signing in again after a claim has been submitted

Just spotted this, nothing to do with your PR but I think given we have a nil check on the password_auth & claim_not_submitted we should pull the object check out of the method and on to the validate method to be consistent & perhaps improve the method name too.

```ruby
validate :presence_of_claim
#becomes something like
validate :session_not_found, unless: claim
```