Add password policy setting `suggestChangeOnLogin`