fixed password verification for existing users