why dont you turn on password logging and see whats actually happening?