When the user request a reset password link, the user.state is set to request_password_reset.

Which means the user will only be able to reset their password, and not sign-in.
Once the user resets the password the user state is set to active once more.
If the link is used a second time they will be redirected to the index page with a message
that the link in the email is not longer valid.

tests/app/main/views/test_forgot_password.py

@@ -1,5 +1,6 @@
 from flask import url_for
 
+from app.main.dao import users_dao
 from app.main.views import generate_token
 from tests.app.main import create_test_user
 
@@ -11,10 +12,10 @@ def test_should_render_forgot_password(notifications_admin, notifications_admin_
            in response.get_data(as_text=True)
 
 
-def test_should_redirect_to_password_reset_sent(notifications_admin,
-                                                notifications_admin_db,
-                                                mocker,
-                                                notify_db_session):
+def test_should_redirect_to_password_reset_sent_and_state_updated(notifications_admin,
+                                                                  notifications_admin_db,
+                                                                  mocker,
+                                                                  notify_db_session):
     mocker.patch("app.admin_api_client.send_email")
     user = create_test_user('active')
     response = notifications_admin.test_client().post('/forgot-password',
@@ -22,6 +23,7 @@ def test_should_redirect_to_password_reset_sent(notifications_admin,
     assert response.status_code == 200
     assert 'You have been sent an email containing a link to reset your password.' in response.get_data(
         as_text=True)
+    assert users_dao.get_user_by_id(user.id).state == 'request_password_reset'
 
 
 def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_expired(notifications_admin,