fixed password part of server auth