Emphasized that user should provide original (not md5-ed) password