use pass_auth to force password authentication