"Not asking for a password on registration means one needs to be emailed to the user, in plaintext." Not really. You can just create the account without a pass

"Not asking for a password on registration means one needs to be emailed to the user, in plaintext." Not really. You can just create the account without a password and let them create it with the 'forgot my password' flow later.