It is still a success here. 
The pwdChangeTime is only checked before we automatically provision a new certificate for the user due to them having a valid cookie.