changing it to `self.password` fails the test, actually.