Replaced one-pager with multiple pages and fixed security bugs

db.go

@@ -88,5 +88,13 @@ func migrate() error {
 			return err
 		}
 	}
+	// Idempotent column additions for older databases.
+	addColumns := []string{
+		`ALTER TABLE users ADD COLUMN must_change_password INTEGER NOT NULL DEFAULT 0`,
+	}
+	for _, s := range addColumns {
+		// Ignore "duplicate column" errors so the migration is idempotent.
+		_, _ = db.Exec(s)
+	}
 	return nil
 }