a new K_user vault key is generated & wrapped under your password (scrypt + AES-GCM).