Add negated test

Password expiry policy should not stop people from logging in if the
password hasn't yet expired.