auth: Remove static variable ths_user from password_check() code