Security review

We have published a 90 day password expiry policy, this enforces that.

We update the `password_changed_at` field based on `user_audit` events that
have been captured, or the March 7th date when the new policy was
introduced; whichever is later.

This uses [devise_security_extension](https://github.com/phatworx/devise_security_extension) which also provides
password history functionality (to prevent the same password being repeated
once it has expired. It wasn't a drop-in piece of work to get that as well; there
were some strange test failures. We might add that at a later date.

```
  1) User migrates correct old-style passwords on sign-in
     Failure/Error: user.valid_password?(password).should == true # We should update the password to the new hashing standard
     NoMethodError:
       undefined method `gsub' for nil:NilClass
     # ./app/models/user.rb:101:in `generate_username'
     # ./app/models/user.rb:114:in `set_unique_username'
     # ./lib/password_migration.rb:26:in `update_legacy_password'
     # ./lib/password_migration.rb:17:in `valid_password?'
     # ./lib/password_migration.rb:26:in `update_legacy_password'
     # ./lib/password_migration.rb:17:in `valid_password?'
     # ./spec/models/user_spec.rb:18:in `block (2 levels) in <top (required)>'
```