api: drop odd creation of password when extern_name is set

The check of extern_name and the interpretation of it seems odd.

Also, there is no point in setting a random password. It can't be retrieved and
used, and not setting a password is more secure.