Revert
r35880 for the moment:
First, it looks like it'll attempt to re-set passwords much more frequently than necessary, and by calling $user->setPassword() it will be re-setting the password on the global account as well.
Second, it can't accomplish the general goal of always setting the local password for autocreated local accounts, since they may be created when no plaintext password is available (eg from an open session, which has only session tokens available, not passwords).