always emit the preSetPassword hook, this should only indicate the intention. Finally the post-hooks indicate if it was successful or not
