add more functionality

- add old passwords to policy check
- add password expire time
- force user to change password
- warn user to change password
- add start_date to have a transition time before first password change

i think its not yet ready for merging, more for a discussion base
later for passhistory check you need the original password for hashing in `auth_verifyPassword`