add password
update app.yaml