use {{url ...}} instead of hardcoding paths, add password fields