Is this just a documentation problem? In the type and provider it doesn't have a password field, rather it has a password_hash field.