So, if I understand this right, the `user` provider for Windows wants a plain-text password, but the user provider for non-windows wants the shadow hash? `<insert rant about poor user experience here>`.