loop over usernames, not passwords