Password is not necessary when using a trusted connection (localhost). Tested by moving mail in and out of Junk folder while monitoring `/var/log/rspamd/rspamd.log`.
Mike Ashley