Summary:
Force New Password still allows access without changing
Detailed Description:
When you set a user to "Force New Password", the user can ignore the "New
Password" form and they will be logged in with full access to the
access-protected pages.