* updateAposAfterLogin option helps implement secondChanceLogin
* aposAfterLogin is a cookie, not a session property, so we don't need sessions for everybody 100% of the time