auth now requires password