improve password handing