requiring password to flag