[security] don't save passwords