wtf...  user passwords don't get set correctly via the API