Password change in a transaction, ensure passwords are truly expired
    
    Wrap the password change extop in a transaction.
    
    Fix the case where a password is reset and then immediately used. If done
    fast enough then the KDC may not detect that the password is expired and
    grant access using the expired password rather than prompting for a reset.
    
    https://fedorahosted.org/freeipa/ticket/1064