rework initial password reset (password generation not in frontend, UI)

when the sign-up plugin is configured to generate a new password (instead of letting the user chose one) it is actually done in the JS frontend code. This should happen on the Java side of things instead. Ideally in the sign-up plugin.