If the password isn't changed, don't re-encrypt it
Grant a -0.5 bonus to entries that have a username