The server sends back the password hash of a newly created user. Not fatal, but not a good idea either.