Test password in request body (should fail).