Biometrics can make logins smoother, but they also turn identity into something that cannot be rotated the way a password or token can.