deregister_options('RHOST') seems necessary using Msf::Exploit::Remote::Udp. PASSWORD and USERNAME are a misprint :(