users now have passwords