can log in with username, email, or phone
force users to change password after sms registration and dont allow same password