WIP for #4665. Deprecates setting salt/password attributes in favor of a
setPassword() method that makes sure everything is done.