not only do not save password, also do not send it