Updated note about why the 'normal' guard doesn't work
Move password to root of attribute tree