mod-auth-shadow password expiration weakness

Account expiration status is not checked during authorization...