Fixed a bug requiring users to change their password.

When a user was setup via the user/setup API, their account was not flagged as needing to change their password on next login. This has been fixed.