bug in auth service for password check