memleak fix : rampart won\'t free the callback-returned password, so better not strdup-and-forget it ...