allow authenticating user without password if explicit request