still working on the password check