make check_password public, fix bugs
interim - start dealing with login