Ok. I think it must be setting the password attribute on the created object to the password hash. If you leave the password blank, then you can use the default password ('test') to log in.