PasswordRequest type with RFC annotations