1) use UserSecretTokent
2) change Logon UI.
add forgtetPassword actions.