rework authenticate vs. validate password semantics