Force redirect back to password form until password got set after one-time-login
You should be able to use hook_init to check for your custom $_SESSION variable (along with other conditions), and then leverage drupal_goto() to send the user back to the password change page.

Rough example:

function MODULE_NAME_init() {
  // Check that the session key exists.
  if (!empty($_SESSION['my_special_session_key'])) {
    // Check to verify the path the user is currently visiting is not the 
    // password change form, or related path.
    // This needs to be customized according to your needs.
    if (arg(0) != 'user' || arg(1) != $GLOBALS['user']-&gt;uid || arg(2) != 'edit') {
      drupal_goto("user/{$GLOBALS['user']-&gt;uid}/edit");
    }
  }
}


You'll also need to unset that $_SESSION key after the user successfully changes their password. You'll likely want to do this using another hook related to the password change form. 

Usinghook_form_FORM_ID_alter to add a custom submit callback to the form is a reasonable choice. 

Here is an example that adds the submit callback to the user's edit form if the $_SESSION key exists.

/**
 * Implements hook_form_FORM_ID_alter().
 */
function MODULE_NAME_form_user_profile_form_alter(&amp;$form, &amp;$form_state) {
  if (!empty($_SESSION['my_special_session_key'])) {
    $form['#submit'][] = '_MODULE_NAME_unset_session_key';
  }
}

/**
 * Custom callback for removing the special session key.
 */
function _MODULE_NAME_unset_session_key() {
  unset($_SESSION['my_special_session_key']);
}


Hope this helps.