avoid logging password, which is sensitive