long_password -> token
delete user after 5 failed pin attempts