use password for private games instead of url token