pull out password checking into functions