Verify first-time access

Use OTP verification before creating a password. This keeps first-time access separate from sign-in and password reset.