used app variables to mask passwords so that they are not publicly viewable