The UserWriteStage writes prompt_data['password'] via user.set_password(). A PasswordStage only authenticates the current password. Document the correct mechanism (password field on the default-user-settings prompt + empty-password guard policy) and the throwaway-user verification.