move pw out of config