only checking password if it is required.