Is it possible to determine within a rule if a login is the first one since a password reset occurred?