Why is the client removed? Would this change always allow password requests from any client application?