Password can be NULL, changed model