Set a password, deal with the conditions, and prove their current email address via the hook we post