auth: reusable functions for password verification