better handling of invalid passwords