deleted jsons, removed hard-coded pw, added todos