Should `set_password?` be checked here?  What happens if we pass `:password => nil` in, does it ignore it or set no password?  (I think we would want the former, hence I wonder if we should move the check.)