really minor nitpick, but suggest "require password when using legacy auth"