allow refund/rebate password to be passed in as an option to the refund call