Error on password expiry

Error on login or or re-authorization when a user's password has expired, and
dump them back to the login screen.

Also fixes a bug when a suspended account that was already logged in would
attempt to re-authorize (previously this resulted in a 500).
not sure if you already noted, but the API error is currently identified as the generic `invalid_params`. Will need a pull in API to add a unique error id there.