require password when verifying account