now you can't login without a password. pretty important until we get oauth going