Microsoft is right, mandatory password changes are obsolete