prevent password mis-match