Accept password in request as well as session auth