partially fixed bug: incorrect password can also signin