validPassword is always called...