converted password to char array

String is saved in the pool until it is destroyed by garbage collector,
char array is safer.