use cfoundry client's password score instead of digging up uaa client's

[fixes #44621411]