If a value for swift_user_password is not filled in the All in One Controller host group UI, I get the following complaint when running the puppet agent:

    Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Must set a swift_user_password when swift auth is being configured at /usr/share/openstack-puppet/modules/openstack/manifests/keystone.pp:386 on node c1a1.example.com

Not sure we should actually change anything here unless we want non-empty-string default passwords everywhere.