allow for skipping password validation if the user has a different auth