diff --git a/NEWS.md b/NEWS.md
index c7561f47..33e2f287 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,11 +1,12 @@
 # httr2 (development version)
 
 * `req_cache()` now defaults the `debug` argument to the `httr2_cache_debug` option to make it easier to debug caching buried in other people's code (#486).
+* `req_oauth_password()` now only asks for your password once (#498).
 * `req_url_query()` now allows you to opt out of escaping for multi-value parameters (#404).
 * `req_perform_parallel()` now works correctly with `req_cache()` (#447).
 * `req_body_file()` now only opens a connection when the request actually needs data. In particular, this makes it work better with `req_perform_parallel()` (#487).
 * `req_perform_parallel()` now works when downloading 0 byte files (#478)
-* Corrupt `rds` files no longer cause the request to fail.
+* `req_cache()` no longer fails if the `rds` files are somehow corrupted
 
 # httr2 1.0.1
 
diff --git a/R/oauth-flow-password.R b/R/oauth-flow-password.R
index 88bf2f65..620ad2cc 100644
--- a/R/oauth-flow-password.R
+++ b/R/oauth-flow-password.R
@@ -33,7 +33,6 @@ req_oauth_password <- function(req,
                                cache_disk = FALSE,
                                cache_key = username) {
 
-  password <- check_password(password)
   params <- list(
     client = client,
     username = username,
@@ -56,12 +55,11 @@ oauth_flow_password <- function(client,
     interactive = is.null(password)
   )
   check_string(username)
-  password <- check_password(password)
 
   oauth_client_get_token(client,
     grant_type = "password",
     username = username,
-    password = password,
+    password = check_password(password),
     scope = scope,
     !!!token_params
   )
diff --git a/R/req-body.R b/R/req-body.R
index 8b52a035..2b2382eb 100644
--- a/R/req-body.R
+++ b/R/req-body.R
@@ -203,16 +203,13 @@ req_body_apply <- function(req) {
 
   if (type == "raw-file") {
     size <- file.info(data)$size
-    started <- FALSE
     done <- FALSE
-    con <- NULL
+    # Only open connection if needed
+    delayedAssign("con", file(data, "rb"))
 
     # Leaks connection if request doesn't complete
     readfunction <- function(nbytes, ...) {
-      if (!started) {
-        con <<- file(data, "rb")
-        started <<- TRUE
-      } else if (done) {
+      if (done) {
         return(raw())
       }
       out <- readBin(con, "raw", nbytes)
@@ -226,7 +223,6 @@ req_body_apply <- function(req) {
     seekfunction <- function(offset, ...) {
       if (done) {
         con <<- file(data, "rb")
-        started <<- TRUE
         done <<- FALSE
       }
       seek(con, where = offset)
diff --git a/tests/testthat/test-req-throttle.R b/tests/testthat/test-req-throttle.R
index 6d8e8c4b..ac91b434 100644
--- a/tests/testthat/test-req-throttle.R
+++ b/tests/testthat/test-req-throttle.R
@@ -9,7 +9,7 @@ test_that("first request isn't throttled", {
 
 test_that("throttling causes expected average request rate", {
   skip_on_cran()
-  skip_on_covr()
+  skip_on_ci()
   throttle_reset()
 
   nps <- 20