add password auth