I dont't enjoy the way the password is updated : first set as plain text, then encoded.
I'd rather prefer a `public function doUpdatePassword(User $user, $password)`