A new web standard will "kill" passwords