do not validate password. Should be done by the services using
AASWebService