Ignore non-String shop params in login_again_if_different_shop

[Hammadk]

Reverts #430, and adds a test to prevent regression.

In #430, I removed the params[:shop].is_a?(String) check from LoginProtection:: login_again_if_different_shop because we didn't think it was needed.

While working on another project I found out that this check is needed. Consider the case where someone has a Shop model in Rails. When they use form_for in a controller, Rails passes along the params under the shop hash, so:

shop : {
  id: 123,
  foo: bar
}

If this hash is passed to login_again_if_different_shop, the following check is always true: shop_session.url != params[:shop]. Of course, using the non-default param gets around this.