I'd prefer this parameter to be named "hash" or "passwordHash". `password` is scary, because at first sight one could think the actual password is in it.