that is a good suggestion.
That way the 'admin' has no passwd and needs to initially create a custom one, in that update/put request