If you turn off email verification users can set their own password upon registering; however this is a spam feature that I don't recommend you use...
It's best to leave email verification on as to force them to recieve their email and update their password, as you ensure the email address works.
