docs: public void createPassword(PersonForm form, String token) {
  
          final String username = form.getUsername();
  
          // Re-validate the token to prevent URL hacking
          if (!validateLoginToken(username, token)) {
              throw new RuntimeException(
                      "Attempt to set a password for user '"
                              + username
                              + "' without a valid security token");
          }
  
          final String password = form.getPassword();
          if (StringUtils.isNotBlank(password)) {
              if (!password.equals(form.getConfirmPassword())) {
                  throw new RuntimeException("Passwords don't match");
              }
  
              ILocalAccountPerson account = accountDao.getPerson(username);
              account.setPassword(passwordService.encryptPassword(password));
              account.setLastPasswordChange(new Date());
              account.removeAttribute("loginToken");
              accountDao.updateAccount(account);
              if (log.isInfoEnabled()) {
                  log.info("Password created for account:  " + account);
              }
          } else {
              throw new RuntimeException(
                      "Attempt to set a password for user '"
                              + form.getUsername()
                              + "' but the password was blank");
          }
      }