more on password security considerations