fixed password handling