I've added an assert to check that we get the expected number of calls to the password cb here.