add more functionality

- add old passwords to policy check
- add password expire time
- force user to change password
- warn user to change password
- add start_date to have a transition time before first password change

i think its not yet ready for merging, more for a discussion base
Instead simply create a passhistory for the user and let the password expire after the configured time.