change password from string to password, add username to whitelist