Passwords in api should generally be treated as char[].