Moving password validation into IAccessBackend