Minor style nit: prefer `data.password_sha` since there's no need to use a string key here.