Spotted whilst trying to understand how to document this.
The expiring-password.vm tenplate expects environment to have been set up and
expiring-password.xml does not set it up.
I'll notice that it also does not set up rpUIContext (but that isn't documented).
Not 100% sure but it looks like both these should be added?