setting user.password_set flag to true when generating new OTP
updated csf