The BMC is at much higher risk for rejecting the password
(e.g. the password does not pass complexity requirements). If the
username changes, but the password is still default, it is very
confusing. Give the password change the chance to break the
configuration process first.