This is in conflict with the [comment here](https://github.com/meteor/meteor/blob/devel/packages/accounts-password/password_server.js#L427). They are saying that custom keys are allowed!