set user.last_login when they log in, null by default