prevent logging on passwords