It wasn't a bug before. I just needed access to `this` inside hasPassword, to check for `allowUnverified`