no this should run after creation.
The problem was that we may have:
```
$user = new User();
$user->username = 'dionyziz';
$user->password = 'secret1234';
$user->email = 'dionyziz@gmail.com';
$user->save(); // if we don't unset $user->password and $user->salt after save, we will have a problem on $user->renewSessionId
$user->renewSessionId(); // user->update() runs, if password isset it encodes it
```