I have to disagree with this point

    Despite plenty of guidance to the contrary, the first point is really not where we want to be. The problem with doing this is that it means a persistent password – one you can go back with and use any time

If a developer can't work out how to implement a one-use password that forces a password change after login, they shouldn't be writing code.