changing to 'is_allowable_password_reuse' which is a bit more descriptive.

Can I push back on the request to put as method on User?