Also, since you're asking users to type in their matrix password onto https://hummingbard.com, it would be nice to have some understanding of why (even though you can host anything anyway).
As for the password, Hummingbard needs it for the same reason that a server-hosted webmail client like Roundcube needs your email password to log in.