2 cases: (1) after successful login, when password has expired. (2) a link "change password" was clicked in the 'hosting' application.
