Added ppolicy_use_lockout keyword; Default behavior is not to issue the

PP_accountLocked error for locked accounts. (Gives too much information
to attackers.)