Imply authentication when a password is set
Add references, correct disclosure date