Add spec to cover resetting expired passwords