feat(security): #328 delete old sessions forgot password [tbs]

handler/auth.go

@@ -294,7 +294,7 @@ func (handler AuthImpl) handleChangePasswordComp() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 
 		session := middleware.GetSession(r)
-		if session.User == nil {
+		if session == nil || session.User == nil {
 			utils.DoRedirect(w, r, "/auth/signin")
 			return
 		}