The method *"getPassword"* is the proof that we are probably doing password validation incorrectly, that's my gut. We should never retrieve user's password or store it at our database. My suggestion is to make the method *updateUserPasswordAndRole* accept two Strings and remove these methods from *Developer*.