what if password is actually not defined? It'd be nice to catch bugs where the caller has a typo or something and passes the wrong (i.e. non-existent) variable into `derive()`. I never remember the JS rules for truthyness.. would `if (!password)` work?