block user password field at API level.
fix some TODOs.