refinements to choose alternative based on whether a password is
provided in the request.  Also ensured that the username token is not a
NoPassword type.