passwords moved to environment config