Make password-setting explicit, since the deployer will need to know it ...

...later