add basic password strength check
privatize auth internal handlers