Users may not choose the same password that they already had.

Users are not allowed to browse the site until they change their password.