only password of the user who locked is needed