moved the database password to an env variable