the reason is that social_core.pipeline.user.create_user only
takes username/email fields from kwargs and sends them to
the actual backend. Which means password must be reset *after*
the object has been created!