refactored password logic