newly created password accepted then rejected