identities: non-citizens can now log into app with password