password handling principles established