fixed password matching