Error on password expiry

Error on login or or re-authorization when a user's password has expired, and
dump them back to the login screen.

Also fixes a bug when a suspended account that was already logged in would
attempt to re-authorize (previously this resulted in a 500).
doh, just saw the api pull!