After investigating parse-community/parse-dashboard#231 I discovered that Parse.com _SCHEMA collection doesn't always have the password field in the _User collection. The Schemas API should return the password field regardless of the contents of the _SCHEMA collection, as it's a special field.