Treat passwords like HRCI