Add test to check the password is not saved clear-text
Check if the new user can login
FIX: use set_password() for new users' password