Do not allow users in pre-release and staging environments to login using password=password (including in different cases) from the web app

[petmongrels]

• The check should be on the frontend
• Show a nice error message when this happens to the user with details of what they can do.

Simple workarounds are:

• login to the same user from prod and change password (only if these are not customer users)
• login via super admin or org admin and change password

[petmongrels]

• the message saying password change is required is too short. people will not know what is wrong
• lets make a case insensitive check