make it possible to get login qr code after first login, as long as password is not set.

app/auth/routes.py

@@ -56,8 +56,8 @@ def generate_auth_hash(username):
     if user.auth_hash:
         flash('Auth hash is already generated')
         abort(403)
-    if user.last_login:
-        flash('After a player has logged in, it is no longer possible to generate a QR code.')
+    if user.password_hash:
+        flash('After a player has created a password, it is no longer possible to generate a QR code.')
         abort(403)
     user.set_auth_hash()
     db.session.commit()
@@ -89,8 +89,8 @@ def user_qrcode(auth_hash):
     user = User.query.filter_by(auth_hash=auth_hash).first_or_404()
     if not current_user.owns_game_played_by(user):
         abort(403)
-    if user.last_login:
-        flash('After a player has logged in, it is no longer possible to request their QR code.')
+    if user.password_hash:
+        flash('After a player has created a password, it is no longer possible to request their QR code.')
         abort(403)
     img = generate_qr_code(url_for('auth.user_hash_login', auth_hash=auth_hash, _external=True))
     return serve_pil_image(img)

app/templates/game_player.html

@@ -16,13 +16,13 @@
             {{ wtf.quick_form(form, button_map={'submit': 'primary'}) }}
         </div>
 
-        {% if player.user.auth_hash and not player.user.last_login and not player.user.password_hash %}
+        {% if player.user.auth_hash and not player.user.password_hash %}
         <div class="row">
             <a href="{{ url_for('auth.user_hash_login', auth_hash=player.user.auth_hash) }}">
                 <img src="{{ url_for('auth.user_qrcode', auth_hash=player.user.auth_hash) }}" alt="qr_code_failed" width="80%" title="login code for {{ player.user.name }}">
             </a>     
         </div>
-        {% elif not player.user.last_login and not player.user.password_hash %}
+        {% elif not player.user.password_hash %}
         <br>
         <div class="row">
             <a href="#" , id="generate_auth_hash">