ask for password when one isn't provided