add password middleware