MDL-42097 auth: Auth plugins must check passwordurl before returning it