We were still passing a 'password' argument around, but it is not used
anywhere because we send a password reset link in the welcome email
nowadays.