  def updated_ajax
    @user = current_site.users.find(params[:user_id])
    render inline: @user.update(params.require(:password).permit!) ? "" : @user.errors.full_messages.join(', ')
  end
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."