Only let hosts think they can change the password.