Set password_changed_at field for security

We want to expire passwords and ensure that we allow recently changed
passwords to continue to work for the promised 90 period.

TODO - check on production-like data - does the string get converted
properly?