auth: now receives password posted as form data