Check for exposed passwords on user changes

This version adds checks for exposed password in the following cases:

• a new user is added
• a password is changed