I think that since password is an expected attribute elsewhere, merging it follows the principle of least surprise.