Do actually set the password if they have a new MD5 one, but don't do it if they have an Illyan SHA