fix test for prior change in how password is assigned in Init
rework Authenticate* APIs for UserAccount output param