Add check for user creation to make sure they cannot be created without password. Add tests for it.