ipa-kdb: Properly set password expiration time.
    
    We do the policy check so we are the only one that can calculate the new
    pwd espiration time.
    
    Fixes: https://fedorahosted.org/freeipa/ticket/1793