There's also auth.settings.login_next
Perhaps you could set one or the other and then figure out some sort of check you can do to determine if it's a first login or not. A better check than first login might be if the profile is sufficiently filled out or not.
