first rush api auth (missing password)