rewrote passport localstrategy to check incoming credentials against both the encrypted password and the unecnrypted temporary_password