Clean-up superclass-overridable password handling

[andyjeffries]

Use a similar mechanism to #100

The current system allows setting in the base class or overriding at a class level, but it would much nicer if it was done like the api_auth example (allows for more functionality and keeps the functionality the same both ways).