Remove 'plaintextPassword'.

'password' can always be either a string or an object (indicating that
it's been hashed already with something). When the server receives a
string, it hashes it with SHA256 before bcrypt.