policy to prevent user doing anything until he changes expired password

Also, single-login links should automatically expire the password upon first login, lock user into password change page until he/she successfully changes it. Not doing so opens so many ways to get locked out of a newly created account... that is a very bad first impression that turns our first-time site users away. We need first time users to stay!