move password into application.yml file