s4:password_hash: really catch the clearTextPasswordAttr case...