* don't insist on a password (this is valid if you have an SSO login) * fix reference to undefined `requester`