ensure all password checking goes through the authenticate plugin hook (for instance in mod_removeme)