Check your control flow. It looks like you'll authorize any AUTH command regardless of password.