We don't differentiate between a user command with a missing password and a user command with an empty password. So a kickstart line such as `user --name=dshea` would be treated as a user with a kickstart-provided, empty password, and when combined with `pwpolicy --changesok` the UI would show that the password is set from kickstart and would allow it to be changed.