r12900: Merge from trunk:

r12900: Merge from trunk:

Correctly handle the case where users logon with an expired password.

In that case pam_sm_authenticate has to return PAM_SUCESS instead of
PAM_NEW_AUTHTOK_REQD or PAM_AUTHTOK_EXPIRED and pam_sm_acct_mgmt has to
take care of requesting an immediate password change. (see the Linux PAM
documentation).

Fixes Bugzilla #1524, #3205. Tested with login, sshd, kdm and gdm on
Linux.

Thanks to Scott Barker <Scott_Barker@mtechIT.com>.

Guenther
(This used to be commit 4cb662ffd76dbe30003c618c94ccf6ebd4afb48c)