update-user command now sets password