Move our basic password checking code from inside the authentication