Security experts no longer recommend password expiration policies that require users to change their passwords periodically. Here’s why.