If we can't decode the Password-With-Header, assume Cleartext-Password