Force user to change password when expired

**Is your feature request related to a problem? Please describe.**
Right now we are not enforcing expired passwords. We need a way to require a user to change their password when attempting to log in with an expired password.

**Describe the solution you'd like**
Update the /token api route to check if the user's password is expired (after validating the password is correct).
If password is expired, return a message back to the caller that the password is expired.

The UI will catch this message and if presented, it will redirect the user to a new change password page where they will need to enter their old password, and their new password.

This UI page will post to a new API route to reset the user's password. This might be the /me route, not sure at this time. This new API route will check to make sure the old password is valid, if so, it will hash the new password with the salt+pepper and store it in the users collection.
We need to verify the user being modified is themselves, so no way another use can use this route to change another user's password.

**Describe alternatives you've considered**
Can this be the same page as the normal change password page that we would offer the user when they just want to change their password?
If so, we would need to put some protections on each page of the UI so they can only get to this one route.
Because of this, I think it should be a separate page, where they can _only_ change their password.

**Additional context**
None

Start at the /token API route and trace how password validation and expired-password status are handled. Review the possible /me route and the stated UI flow before deciding the endpoint and access protections. Done means expired passwords are reported after valid authentication, users can securely change only their own password, and the new password is stored as specified.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.