Merge branch 'password-reset-timeout' into 'master'

Password reset timeout

/cc @jacobvosmaer

See merge request !1428

CHANGELOG

@@ -37,7 +37,7 @@ v 7.8.0
   - 
   - 
   - 
-  - 
+  - Password reset token validity increased from 2 hours to 2 days since it is also send on account creation.
   - 
   - 
   - 

config/initializers/devise.rb

@@ -145,7 +145,8 @@ Devise.setup do |config|
   # Time interval you can reset your password with a reset password key.
   # Don't put a too small interval or your users won't have the time to
   # change their passwords.
-  config.reset_password_within = 2.hours
+  # When someone else invites you to GitLab this time is also used so it should be pretty long.
+  config.reset_password_within = 2.days
 
   # ==> Configuration for :encryptable
   # Allow you to use another encryption algorithm besides bcrypt (default). You can use