fix'ed password handling