The US could finally ban dumb forced password changes