Fix a couple bugs with param processing for passwords

I'm not sure if the intent was for the passwords params to be
 nested under :staypuft_deployment or not, but with code as submitted
:passwords was a separate hash key, parallel to :staypuft_deployment,
so this change was needed for processing to work properly.

If the intent is for the response to have them nested, this can be
fixed to expect a nested hash again, once the underlying problem
is fixed.