Allow LDAP to decide when an expiration warning is warranted
    
    Previously, we were only displaying expiration warnings if the
    password was going to expire within a day. We'll allow LDAP to
    make this decision (by whether it passes us the expiration time).
    
    In the future, we can add an option to clamp this down to a
    shorter period if the local admin prefers it.