implement custom security check
call member set_password only if password really changed !
remove grace period setting
split hook, pass old/new hash
manage errors for change password shortode
first pass on history/aging feature