The default has changed now so passwords aren't set, but I don't think we should do that.  I think this should return true if `attrs[:setpw]` isn't set.