password check on create only