How are you making it Read-Only?
Are you talking about clicking the Command Button, once, editing multiple Records, then clicking it again to make it Read-Only once more?
Or...going to a Record...clicking the Button to make that Record editable...clicking it again to make it Read-Only...moving to another Record...repeating?
As to the password question...I've avoided using a password for this kind of thing by using the Double-Click Event of a Label. Very few end-users realize that Labels can even be clicked...and any that do would have an easy time finding the password.
I've used this approach a number of times without any complaints. Of course, as with any type of security, it depends on how important the security is and who you're protecting against.
Linq ;0)>