It seems that the password is an attribute of user, judging by the code below.