false alarm, turns out passwords matter