If I don't expose password, would it be able to receive password from JSON ? What's wrong with exposing password ?