password trimmed by spaces just when sent to db