Also, validate that database responds to password, and validate that it is hashed.