fix a bug: the password of a user is now validated only with user having to be authenticated