docs: public static Password readFromXML(Element el, String salt, boolean isDefault) {
  	String prefix = isDefault ? "default-" : "";
  
  	// first we look for the hashed and salted password
  	String pw = el.getAttribute(prefix + "hspw");
  	if (!StringUtil.isEmpty(pw, true)) {
  	    // password is only of use when there is a salt as well
  	    if (salt == null) return null;
  	    return new PasswordImpl(ORIGIN_HASHED_SALTED, pw, salt, HASHED_SALTED);
  	}
  
  	// fall back to password that is hashed but not salted
  	pw = el.getAttribute(prefix + "pw");
  	if (!StringUtil.isEmpty(pw, true)) {
  	    return new PasswordImpl(ORIGIN_HASHED, pw, null, HASHED);
  	}
  
  	// fall back to encrypted password
  	String pwEnc = el.getAttribute(prefix + "password");
  	if (!StringUtil.isEmpty(pwEnc, true)) {
  	    String rawPassword = new BlowfishEasy("tpwisgh").decryptString(pwEnc);
  	    return new PasswordImpl(ORIGIN_ENCRYPTED, rawPassword, salt);
  	}
  	return null;
      }