The first person to run setup creates the password. Keep the site private until you have configured it.