working on password auth