remove unneeded constant
add password expiration feature
prevent new password from being same as old password