fixed auth by password and maybe captcha challenge