pwdInHistory vs pwdHistoryDuration

As previously noted, I believe it better to keep expire history based upon time in history not number of history.  The latter leads to the need for pwdMinAge, which from a security perspective, is a really bad idea.

At Isode, we ignore pwdInHistory and instead utilize an additional attribute, pwdHistoryDuration, to control history expiration.

-- Kurt