if user HasPassword then authenticate