Whether you need the password in your testing depends on which method you use for restoration.
If you select the restore link from backup-specific part in the web gui, you are not asked the password because the web gui finds it in the local database Duplicati-erver.sqlite.
But if you do the restore via main menu, you will be first asked the target location from which to restore, and down the line also the password, because that method does not know about your local databases.