You don't send the password, just the account name.
I don't see any harm coming from that