please review: Ticket 49751 - passwordMustChange attribute is not honored by a RO consumer if using "Chain on Update"