track the first login for users and also ditch password (since it's not needed anymore)