More thorough password checks

Prior to this, the password checks could be circumvented by using the `/admin/password_change/` url. This pull request closes that loop hole, but also tried to create a more permanent solution.

* Add a proxy model, `Editor`, which will throw a validation error when trying to set a password that doesn't meet our requirements. This error occurs very late in the game, though, so would generally result in a 500. It should be thought of as a final safety
* Add a authentication "backend", which makes sure to return `Editor` objects instead of `User`s
* Replace the password change form with an extended form for checking the password requirements. Previously, we had only replaced the password setting form in the `Users` admin
* When a user's password has expired, redirect them to `/admin/password_change/` instead of the `Users` admin page, as this requires fewer permissions
* Duplicate and consolidate tests to review the above