moved password to config file