The Onboarding Password Mistake That Creates Unnecessary Risk