[support] bots getting past password protection