After trying in a real browser using Postman, a bug was exposed - if you tried to get a sale without passing a password at all, we got a 500 error.  Now reproduced in unit tests and integration tests
Previous bug now fixed by allowing the hashed password to be nil and rejecting it at the model.