fixed password checking