Improve specs for password expiry