moved password into an environment variable