Microsoft says mandatory password changing is “ancient and obsolete”