uniquify the signin_url

Since there can be only one signin_url per AWS root account and the name
must be globally unique, it may be possible to have a collision later
either by accident or because someone copies the pattern and scoops the
name (race condition/security problem).

The uniquification while on the one hand seemingly inconvenient, is not
too onerous if sent in a link via email (which is the next step in the
development of the experiment), but it also ensures that:

- during testing we don't accidentally conflict with each other while
  trying to test at the same time.

- someone with a class of the same name, e.g. physics101,
  won't conflict.

- the url will not be easily guessable by attackers who might target an
  easily discoverable url with a dictionary password attack.
- [X] force changing password at first login
remove extraneous import json