Set random password when creating user using oauth to prevent `null` issue & potential security hole

Refs #661