for a given path, accept the first password that comes, retire it after last client disconnects