password cleanup