when we should enforce users to login at mobile app startup and when we can postpone it? What are the best practices for this?