Add some tests to clarify the "must-change-password" behavior

Add some tests to clarify the "must-change-password" behavior #18618