Allow password to be null (to support alternate auth mechanisms like oauth.)