password fields were plaintext. switched them to password