user-provided password from registration now used, duh