should also be able to change passwords in the PASSWORD_EXPIRED state