Makes sense, didn't realize that's how we handled password on create.