this only applies if the user has not removed the password auth method and they dont use google or github to log in.
@jeffalo there is a bug where you can make you password nothing, when creating an account just fill in the username and hit enter, then you will have no password, it even works when logging in meaning someone who forgot to choose a password can easily get hacked and locked out.