No password protection on 'expand' action.