I changed both. (I have no idea what the default 'user' user password is, so I just changed it to one of my choosing for being able to SSH in as user. That's right, sometimes I don't want to SSH in as root.)

I've never had the issue you had (I've been through a couple of user password changes, at various 'ages' of the system post-whenever-the-latest-reflash-was), so I suspect something else went wrong on your device. (Or maybe some program you installed really was written in a way that expected user to have a specific password...*Shrug* It's definitely not the CSSU though, since I have that too.)