can't we simply override the password field in our custom user model, instead of using this hack?