this test is excatly the same as 'should be true for a old password when password expiry is activated'. that doesn't seem right.