Enable increased login security

[pglombardo]

Description

This PR improves the security of logins.

If you're not using logins in your Password Pusher instance, this PR won't apply to you.

Changes:

1. Confirmation, password recovery and other workflows will now behave the same regardless if the e-mail provided was right or wrong. This avoids confirming whether an account exists or not in the system.
2. Account confirmations must now be done within 3 days otherwise the user will have to request a new confirmation token.
3. User sessions now timeout in 30 minutes of no activity. Being a security product with sensitive data, this is appropriate.

Related Issue

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Checklist

• I've written tests (if applicable) for all new methods and classes that I created. (rake test)
• I've added documentation as necessary so users can easily use and understand this feature/fix.