user can only register with correct password