security rules - mods for new /login and /users.