I just did some small optimizations today. I realized that anybody could just “url-hop” to get to a password view and create a password - so I fully locked down all password views securely.