Fix handling of password without header

and add unit tests