s4:dsdb/password_hash: split out a update_final_msg() function