More `password` as optional evidence

This time from the WHATWG.

Huzzah!