password creation for new users, closes #232