auth: now verifying password