Both sides have to prove they have the PSK/password before the connection is established. This is of course done without sending the password in plain text.