Authentication happens against the WASF certificate service (SSO) — wasf-website never stores your password.