explain why CheckPassword happens in client thread