uses strong parameters in password_expired_controller