Thank you everyone for your suggestions. There are reasons why we specifically want to use Moodle for this survey, rather than one of the on-line alternatives. The missing piece of the jigsaw was: a page break after the second (conditional and required) question, as well as one after the password question. I've also inserted a label on the second question page explaining that if there is no question on the page it means that the password has been entered incorrectly and that the user should click 'Cancel' and try again. Otherwise the operation becomes confusing for a legitimate user who has just made a mistake with the password.