move password into 'configuration file'