handle local password policies
comments are always good.

It's tough to understand this fix, thus putting some descriptive
comments.
Clarify comments on Windows API behavior with direct link to documentation