title: What's the good http status code to return on expired password?
body: <p>When a password is expired what rest api should return? I mean: username and password are correct, but expired.</p>
  <p><a href="https://www.rfc-editor.org/rfc/rfc7235#section-6.2" rel="nofollow noreferrer">Here</a> I found that</p>
  <blockquote>
  <p>The mechanisms for expiring or revoking credentials can be
  specified as part of an authentication scheme definition.</p>
  </blockquote>
  <p>Is there a specification about what's the right and/or correct http status code for expired credentials? Is http status code good to handle with credentials expiration?</p>