Hi,
the attached patch fixes #2271. Kindly see the patch and the commit
message for more details.
I tested password change w/o OTPs to make sure we don't regress and also
with TOTP. I tested both expired passwords and password change via PAM. HOTP
currently doesn't work because of another bug.