chore(passwords): move core password functionality to PasswordService