Split tasks into different logical sections

Also reorder, so that users are added *before* password-based login is
turned off...