Updates to better report some NTSTATUS errors into PAM, and update to PAM

Updates to better report some NTSTATUS errors into PAM, and update to PAM
to correctly allow password changes on expired passwords.  (No security
implications, as its just a 'will I let you talk to the server' check).

pam_winbind checks the password prior to changing it, so that users don't
have to make up and type their new password when they havn't even got the
old one right.  This also helps with stacking etc.

Andrew Bartlett
(This used to be commit 2b78d493002a3ba13533429c6a14f5c0a92f43d1)