new user, bug in password