Idea is to put unhashed password back into data. But, no matter how soon it happens, client can see it happening on the form. So instead of working on data object, we are working on another object extended from data. I agree there is too much extending going on, and can be done more elegantly, but I didn't want to change existing code I don't fully understand.