tested for password-based validation