only clear password on bad login