can verify passwords against db and retrieve user id