this only applies if the user has not removed the password auth method and they dont use google or github to log in.