Both spins require a valid password. Heavy spin only works for referrers who have an eligible verified direct referee (not yet used).