Users w cookies from old system are redirected to reset pw when they try to log in.

Once they're changed their pw, the old userdata cookie is deleted, and they won't
get the notice again.