The "password" cvar is used on the server to set the password clients need when connecting. The same cvar is used on the clients to set the password. In short, "password" on the client and server must both be set to the same thing for a client to be able to connect. By default, the auto-record setting is set up to record when a server is passworded (such as a match server).