relax checking for IPasswordHistoryIdentity in unusedNewPassword validator; don't require IOneTimePasswordIdentity interface when one time passwords are disabled