better error message for when password is incorrect