AvoidUserNameAndPasswordParam is firing even when user is supplying the password as a secure string.