Why are we encrypting the data instead of the password? It seems like it would be more secure to still require a password to authenticate against but encrypt that with the key.