improve password handling