code: public User createUser(final User user) throws UnauthorizedException {
          User requestingUser = getCurrentUser();
          if (requestingUser != null && !requestingUser.isAdmin()) {
              throw new UnauthorizedException("Only admins can create new accounts!");
          }
          tt.execute(new TransactionCallbackWithoutResult() {
              public void doInTransactionWithoutResult(TransactionStatus status) {
                  boolean success = false;
                  try {
                      PasswordEncoder encoder = new ShaPasswordEncoder();
                      String hashedPass = encoder.encodePassword(user.getPassword(), null);
                      user.setId(insert(
                              "INSERT INTO Users (username, password, enabled) "
                              + "VALUES (?, ?, ?)", user.getName(),
                              hashedPass, user.isEnabled()));
                      addAuthority(user.getName(), ROLE_USER);
                      if (user.isAdmin()) {
                          addAuthority(user.getName(), ROLE_ADMIN);
                      }
                      success = true;
                  } finally {
                      if (!success) {
                          status.setRollbackOnly();
                      }
                  }
              }
          });
          return user;
      }
docs: NOTE: Password is hashed before being stored