validate passwords using sasl