XXX comment in the logic which sends failed password auth back to username