password authenticaton broken?