#25 - leaving legacy password check for backwards compatibility