password does not have to be unique