password verification released as callback