After initial install new user accounts corrupted until restart
After initial installation, new user accounts will get created with encrypted passwords that can't be decrypted after restart. User accounts created after the initial install are ok.
Problem was the the cipher was getting created before the passwordKey could get saved (while setting the admin password in the setup tool). Fix is to not create the cipher if the passwordKey can't be set.