added password parameter to validate api