Don't smash passwords with newly alloc'd zero array