user: do not set the password via the CreateUser() call.

Moving passwords (even if they are hashed) through the bus is not great and it's, in fact, a pretty bad security issue.
Passwords should be set via the ChangePassword() call (if via UI) or manually using the good old passwd.