Can password be null here?