jeffh: do not hardcode password