Remove requirement for a password but bail under certain actions

Deletion shouldn't require a password, so to accomodate that we have to
eliminate the requirement for a password, but doing that means the create and
update actions could silently fail. So we'll throw a fatal! if the user doesn't
provide one in those cases.