We don't plan to actually validate a password, right? In which case we're probably just storing a hashed string "password" or something like that. Is that remotely accurate?