OAuth users can set a password on their settings page if desired