fixed a bug, so users can only log in when they enter the correct password