How are passwords and authentication handled under PCI