Force user to change email / password on first login. Partially completes #6.
Login is now all front-end, not server-side. User can now modify profile. Closes #6.