A Mighty bug ... passing username as password