Add devise security extensions

Want to explore the impact of adding password expiry and password
history features.
Make passwords expire after 90 days
Use value defined in configuration

Make the test less fragile to changes in the policy happening in
the config initialiser.
Add negated test

Password expiry policy should not stop people from logging in if the
password hasn't yet expired.