password_changed_at
It's still missing an enforcement which redirects all actions to profile update until the password is changed