Discussed with the team findings, and received advice that this will be fixed. The is_login will be added to the user database as this will be the basis of when to be redirected to the change password page, and the entity sharing will be hidden to a regular user.