fine tuned password handling as we were getting false positives, probably caused by other changes up the stack that now call these functions in more cases.