I think there should be a spec for this method (the existing specs are stubbing this method) - especially because `UserPassword#expired?` should be tested on the spec level too.