Whether a sign-in with a breached password is refused until the password is reset.
final bool sessions;