Password auth phase1