t455: ensure we set an initial password for each user created - if changed by the user, we will not overwrite the hash