Fix session creation for auto-login when resetting password

[typerandom]

Fixes so that a session cookie is created when web.changePassword.autoLogin is enabled and you're resetting the password for an account.

How to verify

1. Create a new application using this gist.
2. Start the application.
3. Navigate to the forgot password page (http://localhost:3000/forgot) and reset the password for one of your accounts.
4. Click the reset password link in the email you received and change the password for your account.
5. You should be redirected to / and logged in.

Fixes #164

[coveralls]

Coverage decreased (-0.5%) to 70.974% when pulling 684a71c on fix-password-reset-autologin into f1abe55 on master.

[robertjd]

I've verified that this PR fixes the reported problem, however I'm also noticing that the pre/post handlers are not being run for this case. Can we refactor the code to handle those cases as well? I know it may touch many files, but it seems like we can consolidate a lot of this.

[coveralls]

Coverage decreased (-0.4%) to 71.15% when pulling 860a79d on fix-password-reset-autologin into f1abe55 on master.

[coveralls]

Coverage decreased (-0.4%) to 71.15% when pulling 860a79d on fix-password-reset-autologin into f1abe55 on master.

[typerandom]

@robertjd The latest changes are now pushed.

[coveralls]

Coverage decreased (-0.4%) to 71.15% when pulling 7248ca7 on fix-password-reset-autologin into f1abe55 on master.

[robertjd]

The intention of this test case is to assert that the developer can end the response inside of their preLoginHandler, and that their response will be the final one.

These modifications don't assert that code path anymore, because the preLoginHandlerInterceptResponseTestFixture has been modified to always call next(), so we aren't testing a custom response by the developer anymore. This test should be reverted back to it's original intent.

[typerandom]

Okay, I see. I'll fix that!

[robertjd]

Thanks @typerandom ! This looks great and I've verified that it solves the original issue.

I do have one issue with a test change, please see my inline comments. In sum: we need to make sure that we have a test case that asserts the developer's ability to end the response from inside their handler, preventing the rest of the next() handlers from running. I'd like to address this test issue before we merge.

[typerandom]

@robertjd I saw your comment and I'll fix the code/test before we continue.

[coveralls]

Coverage decreased (-0.9%) to 70.661% when pulling f7e0708 on fix-password-reset-autologin into f1abe55 on master.

[typerandom]

@robertjd This is fixed now.