These assertions should be made before you set the new password to some arbitrary value