Regarding the Rules only working on reauthentication - there seems to be a solution here:
How would implement this within a rule?