So you can just remove passwords from requests.
It is sent, but is not used now.