prompt users to create a password if none exists and they have to verify their identity
set session as identified if a user created or changed a password