I'd use a different variable name here.... Using user.password might overwrite the value for something that needs it later on...