add default password expiration

When creating a new user we can set their password. Its generally not a good
idea to leave default passwords in place, so by default puppet will expire the
password it creates, forcing the user who sshes with their key to change their
password before logging in.