no password in server.js