password should not be nullable.