distinguished between missing and wrong passwords