Err, don't set the password in plaintext, even initially. If you want to use `auth.passwd_reset`, then set it to an empty password initially. Though I don't know if this is the cleanest solution.