handle incorrect password better