Also, I'm pretty sure this can be reached in code branches where `password` is unset.