users db is hidden, and we dont want to stopm existing sessions so persist password