Shouldn't it return the user `if not password `