now tracks login and rejects bad passwords