Microsoft just dumped password expirations and other companies should too