password handling updated