The password forcing users to change their password keeps showing up on development servers. I've noticed it on rika and now on test.musicbrainz.org too.

Since the passwords have been reset to "mb" on development servers, it makes no sense to force people to change it because they're not actually changing their original password.

Also, "secure hashes user's passwords" on /account/change-password should be "secure hashes of users' passwords"