Yes, that is correct. But we probably shouldn't email the password to the user. Just let them change it. Might consider a one-way hash instead of a two-way one though.