use md5(password) to validate