If you want to prompt the user for a password, but don't care what the password comes back as, set `a-password-mode' to `any'.
If you just want to check if the password they entered has an at-sign (@) in it, set `a-password-mode' to `at-sign'.
If you want to try and get the user to enter in a valid email address, (and not just some jibberish that has an @ in it), set `a-password-mode' to `look-valid' and the program will try to make sure it looks like a real address before letting them login.
Examples:
These days, web browsers use a standard dummy password.