Comment by scrabble

Password through anything is generally a no-no. Your service should have a way of accessing user accounts without their password.