new-password-file should coerce arg to file
Ready for release