New users must change password at first login