- route to changePassword page if the password is passwordExpirationDays old - passwordExpirationDays property under passwordOptions object sets the time interval when password should be changed (90 days by default)