From my tests, we get the correct behaviour - if set_password is false, a password is not set. I don't see why we'd end up with :password => nil if set_password is true - the random_password function should handle that.