return null when user password is wrong in authenticate