replace token with password