fixed password comparison