added todo: passwords shouldn't be stored in plaintext duh