users are sending CHAP passwords