allow password editing, add site_url to config