actually checking passwords now