fix up app controller to handle login and forcing password change