I put some in the commit message: https://github.com/shadlaws/gallery3/commit/1dc41e2de6135aaa20a087f84f9c8a4233391a75

It's not a security hole - failed things still failed.  It was just that if the password field was unset, it'd throw an error instead of report false.  I noticed this when debugging REST, where I'd get a 500 error instead of a 403 error if I intentionally misnamed the field "passwordno" instead of "password".