Locking vendor accounts after their job is over, locking inactive admin accounts at 90 days

Old and unused accounts with admin access are a common entry point for attacks. They often have weaker passwords than a current account and the passwords are not being rotated making the accounts easier to brute-force over a long period.

There are two policies that create a solution to this problem:

1. If a vendor will be doing work for a known amount of time, set their account to expire (be made inactive) on the date their work is likely to be done. This is required by PCI DSS 3.1 section 8.1.4.
2. Lock any admin account if it has not logged in to the site in 90 days. This is required by PCI DSS 3.1 section 8.1.4.

The User Expire module has provided a way to achieve the first bullet point for a while, although it had a few bugs that made it unsuitable for production use. I'm happy to say that those bugs are now fixed in the 7.x-1.3 release as of this morning :)

There's a patch to add the 90 day inactivity lockout feature which I think works fairly well. I would, of course, love some additional help reviewing all the code/functionality in the module and especially this most recent patch.