Flag the current password as weak

Sets passwordWeakSince to the current time if not already set. Called by clients after a HIBP check on login finds the user's password in the breach corpus.