move password upgrade to AFTER login