User must reset their password if it expired

Closes #23