OldPWd now be a slice of Password
add to last commit
prototype for appengine auth manager