If a user login at first time, it should change password. #42