add force_prompt option to enforce new password prompt for use with Token