Expire a password after time limit

Hi guys,
First post, hope it's in the right place.

Reallllly liking Drupal. But I haven't been able to get Drupal to expire a password after x many days. Need that to happen for it to be hipaa compliant, so I started writing for it. I hit an issue with calling the redirect page, outside of that I'm good.

I'm trying to call the password page when the password is expired. The set message works great so I'm hitting that part of the code, but it always goes to the user page, and doesn't call the profile update page. Which one of these is correct, cause I can't get any of them to work..

			drupal_set_message(t('TimErrPass:  You password has expired..'));
 			return url("http://server/?q=user/2/edit");
			user_pass_reset_url($username);
			drupal_goto('user/password');
			return drupal_get_form('user/password', $form);

what I did:
I made a new table (tim_timecode) with a varchar and int for the username and the timecode.

In the user.module, in the user_save function, I wrote some code that writes the current timestamp everytime the user hits submit from the user profile update page to my own table.

	$timecode = time();
	$username = $account->uid;
	$result = 0;
//	echo "Trying: UPDATE tim_timecode SET timecode=$timecode WHERE username=$username";
    $result = db_query("UPDATE tim_timecode SET timecode=$timecode WHERE username=$username");
	$rows_affected = mysql_affected_rows();
	if ($rows_affected == 0){
	    $result = db_query("INSERT INTO tim_timecode (username,timecode) VALUES($username,$timecode)");
	}

And then in the user_login_submit function beneath it I wrote some code to query my mysql db and see when the last time was the user saved their password, and compare it against the current time and the elapsed time variable:

  if ($user->uid) {
	//this is where we look to see if the pass is expired.
	$timecode = time();
	$username = $user->uid;
	$result = 0;
	$secondsToExpire = 36000; //IN SECONDS!
	$secElapsed = 0;
    $result = db_query("Select * from tim_timecode WHERE username=$username");
	$rows_affected = mysql_affected_rows();
	if ($rows_affected > 0){
		$row = mysql_fetch_array( $result );	
		$lastTime=mysql_result($result,0,"timecode");
		$secElapsed = $timecode - $lastTime;
		if ($secElapsed > $secondsToExpire){
			drupal_set_message(t('TimErrPass:  You password has expired..'));  //Works
 			return url("http://server/?q=user/2/edit");  //ignored
//			user_pass_reset_url($username);  //ignored
//			drupal_goto('user/password');  //ignored
//			return drupal_get_form('user/password', $form); //ignored
		}
	}

But I can't get redirect the user to the profile update page. The set message works great, but I can't get the page redirect to work. Can anyone tell me which one of these will work to point the user at the profile update, or password update (if there is one), pages?

If I can get it this far, I can hopefully make some more rules that you must change your password from the current password, can't leave the field blank, and put in a webpage based setup to set the timeout parameter.

Any ideas?
Thanks!!