really get rid of the DB passwords this time. this'll eventually become a custom attribute requirement