last-login-ip
It's still missing an enforcement which redirects all actions to profile update until the password is changed