Security review

We have published a 90 day password expiry policy, this enforces that.

We have a `password_changed_at` field on `users` at the moment, but we
have not been writing to that field. We could update it based on the contents
of the `user_audits` table. This pull request does not do that yet; requires
further discussion as to how hard/valuable that would be, versus just
applying a global update.