I think we still want to set `extra['password']` even if `generated` is `True`. Otherwise there is no way for user to access the generated password, right?