make password optional