Microsoft's new "passwordless by default" is great but comes at a cost