modified setup_user(), now we do not set a password