js checks for user_password