fix password checking