'should be false' isn't the best description for a spec, isn't it? (same goes for the previous specs)

it "should not expire old passwords when password expiry is disabled"

seems to be a more appropriate name