s4:dsdb/password_hash: do the min password age checks first