Require passwords for "request" status in "auth+acct", too