Simplify the 'password must change' logic