allow secret to be missing, which is the case for autocreated users who
have not yet chosen a password and have inactive accounts
make secret non-compulsory in another location
remove guard that doesn't add anything valuable anymore