not only are variables variables, but hashes should be hashes.  Also parameterized password retries