alphagov/signonotron2 — pull request #294 by vinayvinay (2014-12-03 09:42:46+00:00)
Title: Signed-in users with expired password can reset it

www.agileplannerapp.com/boards/173808/cards/8676
fixes: https://govuk.zendesk.com/agent/tickets/874886

by default `require_no_authentication` filter will redirect a partially signed-in user to the after sign-in path, i.e. '/' where [expirable will intercept](https://github.com/phatworx/devise_security_extension/blob/b4f0382f809392ef4337bd65f051b0d6947369df/lib/devise_security_extension/controllers/helpers.rb#L27-L38) and ask the user to change their password if it has expired.

in case of the zen ticket mentioned above, a user with an expired password is unable to reset it, because clicking on the reset password link takes him to the change password screen asking him to input the current password (which he doesn't remember).

we're signing-out the user when they click on the reset password link, so that they're straight-away taken to the reset password screen.