fixed access denied route
hide password and insert default value when applicable