The auth_manual has this so this is either a cut and paste job, or possibly we could lean directly on that code. However this must work ith all the permutations of password being local or not etc