before User has secure password