user now has to validate their password