Don’t expire your users’ passwords.

Don’t require a bunch of arbitrary nonsense in their passwords.