update User.last_login when authed with password

This fixes a stupid bug that always returns "expired_token" for those
who first logged in > 30 days ago.