better PW protection in headers

@darbyfrey