In cases where the server not listens on localhost (#96 and #103) it would add an additional (thin) layer of security to be able to set an "app password" instead of accepting any password. Else the server is practically an open relay, which is probably unwanted.