prompt for password if it's not entered in config (similar to recaptcha)