Set password_changed_at field for security

We want to expire passwords and ensure that we allow recently changed
passwords to continue to work for the promised 90 period.