find_user don't need to check pw