leave it up to the caller to check the password with inverted case