move passwords into their own table and no longer viewable via normal event/settings pages
and add password update form