use a non-obvious temporary password in case something fails between ipa.create_user and ipa.change_user_password