when xml-importing an existing user (i.e. Tree doesn't have status NEW upon import) calling UserManagerImpl.setPassword will force the creation of the rep:pwd node and rep:passwordLastModified property contained therein if theinitial-password-change feature is enabled.
imo the rep:pwd (and any properties contained therein) must not be auto-created by should only be imported if contained in the XML.
proposed fix: UserManagerImpl.setPassword already contains special treatment for the password hashing triggered upon xml import -> renaming that flag and respect it for the handling of the pw last modified.
Alex Deparvu, wdyt?