single-tenant · password auth