When logging into an account that requires the user to change there password, there are a couple issues that cause confusion. 1) If you successfully login, it looks like a failure because you are shown the login form again with a subtle 2nd message and a link. 2) The top message says "Error: Session timed out. Please log in again. This message is misleading and often stops the staff member in their tracks and causes them to try logging in again rather than resetting the password. It is assumed that if you logged in successfully, it isn't an error, and that you need to take the next step, which is to reset your password. I would suggest that the login page not be shown, but a new page that simply has the reset form on it. Another alternative would be to load a modal over the login if successful and state that the password needs to be reset, and provide one button to reset the password, and another to log out and do it another time. Having had to help many staff members walk through this process, I can, without a doubt, guarantee that this process is extremely confusing, even to me. We could definitely improve the workflow here.